I'm moving from ufw to iptables.

There is a default "limit" rule in ufw, which kicks in if an IP address initiates 6+ connections in 30 seconds (sudo ufw limit ssh). I use that limit rule for SSH traffic (port 22).

I've read so many different ways to do this in iptables, that it's just confusing. I'm unsure whether to use the connlimit or limit or some other module.

What is the simplest way to map this rule 1:1 to iptables?

2 Answers 2


ufw manipulates on iptables, so since you're moving from ufw, I guess you can capture your iptables and see what ufw does there.

  • I don't understand what you mean? I'm looking for the iptables equivalent of ufw's ufw limit ssh
    – lonix
    Commented Sep 13, 2019 at 9:40
  • 2
    @lonix List iptables when ufw is active with this policy.
    – user147505
    Commented Sep 13, 2019 at 9:45

Using the recent extension

Based on @Tomasz's idea, I created the rule in ufw and inspected the result in iptables. Seems ufw uses the recent extension:

:LOG_REJECT - [0:0]

-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j LOG_REJECT
-A INPUT      -p tcp -m tcp --dport 22                                                                         -j ACCEPT
-A LOG_REJECT                                                     -m limit --limit 3/min                       -j LOG --log-prefix "[LIMITED SSH]"
-A LOG_REJECT                                                                                                  -j REJECT --reject-with icmp-port-unreachable

Using the limit extension

Which is slightly neater/simpler:

:LOG_REJECT - [0:0]

-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 12/minute -j ACCEPT
-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW                            -j LOG_REJECT
-A LOG_REJECT                                                     -m limit --limit 3/minute  -j LOG --log-prefix "[LIMITED SSH]" --log-level 7
-A LOG_REJECT                                                                                -j REJECT --reject-with icmp-port-unreachable

(Though I'm unsure if icmp-port-unreachable is a proper rejection message in this case.)

Using the connlimit extension

...maybe someone else can add that. :)

  • Why the downvote?
    – lonix
    Commented Sep 13, 2019 at 13:12
  • yes why ? A comment might be a better way to express disagreement.
    – Jérôme B
    Commented Jan 12, 2022 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .