IPTables rate limit per destination IP and port

Question

I currently have these rules:

iptables -I FORWARD -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0>>22&0x3C@8=0xFFFFFFFF' -j SRCDS-TRF
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0>>22&0x3C@10&0xFFFF=0x5453' -m limit --limit 45/second --limit-burst 150 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0>>22&0x3C@9&0xFF=0x55' -m limit --limit 3/second --limit-burst 20 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0>>22&0x3C@9&0xFF=0x56' -m limit --limit 3/second --limit-burst 15 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} --sport 27005 -m u32 --u32 '0>>22&0x3C@9&0xFF=0x71' -m limit --limit 20/second --limit-burst 70 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} ! --sport 27005 -m u32 --u32 '0>>22&0x3C@9&0xFF=0x71' -m limit --limit 2/second --limit-burst 17 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} --sport 27005 -m u32 --u32 '0>>22&0x3C@9&0xFF=0x6b' -m limit --limit 20/second --limit-burst 70 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} ! --sport 27005 -m u32 --u32 '0>>22&0x3C@9&0xFF=0x6b' -m limit --limit 2/second --limit-burst 17 -j ACCEPT

This works, however I'm having to create many of these rules per IP and Port. If I don't supply a IP Destination and Port Destination it acts as a packet limit overall rather than per IP, this causes issues when one application gets a spike in traffic and the rest of them get rate-limited also.

Is there an easier way of creating just one set of rules, instead of potentially having hundreds?

Answer 1

1) Use IP sets, a kernel extension for iptables, to apply your rate limiting rules to a set of IP addresses, and/or;

2) Use Shorewall to help with iptables rules configuration.