IP Tables Rate Limit Apache

Luke Hebert

- 2 minutes read - 259 words

If your Apache server is getting hammered by traffic spikes or a low-effort DoS attempt, a single iptables rule can cap the rate of incoming HTTP connections without touching Apache’s own configuration.

The Rule

iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

What It Does

  • -A INPUT - Appends the rule to the end of the INPUT chain.
  • -p tcp --dport 80 - Matches TCP traffic destined for port 80 (standard HTTP).
  • -m limit --limit 25/minute - Allows a sustained rate of 25 packets per minute.
  • --limit-burst 100 - Permits an initial burst of up to 100 packets before the rate limit kicks in.
  • -j ACCEPT - Accepts packets that match the rule.

Important Considerations

Warning

This rule only accepts matching traffic. Packets that exceed the limit will fall through to whatever policy your INPUT chain has (typically DROP or REJECT). Make sure your chain policy is set to DROP if you want excess traffic silently discarded.

  • Place this rule before any blanket ACCEPT rule for port 80, or the limit will never be reached.
  • If you also serve HTTPS on port 44, duplicate the rule with --dport 443.
  • To make the rule survive a reboot, save it with iptables-save > /etc/iptables/rules.v4 (Debian/Ubuntu) or service iptables save (RHEL/CentOS).
  • Adjust --limit and --limit-burst to match your expected legitimate traffic. 25/minute is conservative; a busy site may need 200/minute or higher.

Verifying

iptables -L INPUT -n -v --line-numbers

Watch the packet and byte counters to confirm the rule is actually matching traffic.