Limit and limit burst in IPTABLES

Question

For some reason I am not able to understand the concept of limit and limit burst in IPTABLES. Could anyone please help me here !

Thank you!

Answer 1

The limit module sets a timer on how often the attached iptables rule is allowed to match a packet.

The limit-burst parameter sets how many packets are allowed to match. The limit time sets how often the limit-burst restores itself.

To boil it down, lets assume first that the burst bit doesn't exist (or is set to 1, amounts to same thing). The actual limit parameter specified simply sets the timer, for both the rule and the limit-burst. So setting it to 5/second would make the timer 1/5th of a second, and setting it to 4/hour would make the timer 15 minutes. No packet will match the rule while the timer is running (so if it's an ACCEPT target rule, no packet would be accepted for 1/5th of a second or 15 minutes, depending).

So to complicate this... The limit-burst parameter acts like a packet counter. For every one packet that matches, the count goes down by one, and the timer starts (or restarts if its already running). The rule still matches anything that comes in. When the timer finishes, the count goes up by one. If the counter hits 0, the rule stops matching, until the timer finishes and the count goes back up to 1 again, and continues counting up by the timer until it gets back to the burst you set.

So setting burst to 1 means you are very literally matching 1 and only 1 packet per timer interval, and setting it higher means you are creating a buffer on that timer before it is strictly engaged.

As a rough example, lets say you have a burst of 10 and a timer of 1/second, on an ACCEPT rule. Lets say you get 20 matching packets all within a second. The first ten match and are accepted, the rest do not. Ten seconds after that, the burst counter is back to maximum of 10. Now 5 matches come in (within a second), they all match no problem, counter would now be at 5. 2 seconds go by without matches, putting the counter at 7. Another 20 matches come in; the first 7 would match and accept, the rest not.

Paraphrasing largely from this document, which has further examples in the section that documents the limit module.

Answer 2

--limit: Specifies the rate at what tokens get refilled into the bucket. 4/hour means 4 tokens per hour (1 token every 15 minutes).

--limit-burst: Specifies the maximum amount of tokens that can be filled in the bucket. (This is also the amount of tokens the bucket starts out with).