set packet rate limit via iptables

Question

I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected.

How can I restrict the internet access of this program?

I tried the suggested command:

iptables -A OUTPUT -m limit --limit 10/s -j ACCEPT

but I get a fatal error message:

FATAL: Error inserting ip_tables (/lib/modules/3.2.0-67-generic/kernel/net/ipv4/netfilter/ip_tables.ko): Operation not permitted
iptables v1.4.12: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

With administor rights:

sudo iptables -A OUTPUT -m limit --limit 10/s -j ACCEPT

there is no errror message anymore. But it is still not working, I get disconnected.

Is there an error in the command line? Or do I have to use other arguments of iptables?

Below is the actual message that I get, when I exceed the limits of the provider.

Up to now, I tried different approaches, but none of them didn't work.

sudo iptables -A INPUT -p tcp --syn --dport 8621 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 9/second --limit-burst 10 -j ACCEPT

sudo iptables -A INPUT -p tcp --destination-port 8621 --syn -m state --state NEW -m limit --limit 9/s --limit-burst 10 -j ACCEPT

This approach seems not to help in order to still use the application. So, I posted another question: set connection limit via iptables .

Answer 1

The solution you found was correct:

iptables -A OUTPUT -m limit --limit 10/s -j ACCEPT

But it is assuming a default policy of DROP or REJECT which is not usual for OUTPUT. You need to add:

iptables -A OUTPUT -j REJECT

Be sure to add this rule after the ACCEPT one. Either execute them in this order, or use -I instead of -A for the ACCEPT.

Also, depending on the application this might kill the connection. In that case try with DROP instead of REJECT or try with a different --reject-with (default is icmp-port-unreachable).

I just tested with telnet against a DVR server and it didn't kill the connection. Of course, since a new connection is an output packet, trying to reconnect right after hitting the limit will fail right away if you use REJECT.

I gather from the comments that your ISP also expects you to limit your INPUT packets... you cannot do this. By the time you are able to stop them they've already reached your NIC, which means the were already accounted for by your ISP. The INPUT packet count will also increase considerably when you limit your OUTPUT because most of the ACK won't make it out, causing lots of retransmissions.

10 packets per second is insane.

Answer 2

Syn-flood protection:

# iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

Furtive port scanner:

# iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

Ping of death:

# iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT