ipt-ratelimit linux kernel module by abc@openwall.com -- (c) 2015-2020.
An high-performance implementation of committed access rate, or simply rate limiting, or policing for Linux iptables. Suitable for a lot of users (similar to ipset) and does not have qdisc limitations. Supports IPv6.
Official project homepage @ https://github.com/aabc/ipt-ratelimit
ipt-ratelimit module implements traffic policing (i.e. limiting traffic bit rate) using, standard for this purpose, token bucket filter (TBF) algorithm. Particular implementation is based on FreeBSD's implementation of Cisco's TBF with extended burst value (which is used to implement RED-like drop behavior).
Module is compatible with recent linux distributions such as Debian 7, 8, Centos 7, and Linux kernel 3.x or above.
Does support IPv6, thus useful for dual-stack policing.
Three easy steps:
** 1. Prepare Kernel source for module compilation
What to do for Debian and Ubuntu:
sudo# apt-get install module-assistant
sudo# m-a prepare** 2. Prepare Iptables
What to do for Debian or Ubuntu:
sudo# apt-get install iptables-dev pkg-config** 3. Now, to actually build the module run:
~/ipt-ratelimit# make all install
~/ipt-ratelimit# depmodModule parameter:
parm: hashsize:default size of hash table used to look up IPs (uint)
Parameter hashsize allows to specify size of every set's hash table (default value is 10000). Increase if you plan to use more IPs than that. Best value is twice as much IPs you are planning to use.
iptables options:
ratelimit match options:
--ratelimit-set
Both options are mandatory. Every set should be first created with iptables
before it will have configuration file /proc/net/ipt_ratelimit/
To create set named "name0", for example:
This command will work like this:
Usage of set files:
To add IPs or CIDRs to the set write string in the following format:
+IPv4[,IPv6,CIDR...] bitrate [normal_burst [extended_burst]]
Examples:
ratelimit network 10.0.0.0/24 to 1Mbit.
these three lines are equal, because normal burst (cbs) and extended burst (ebs), when not specified, are calculated automatically by optimal formula:
normal_burst = bitrate (1 byte)/(8 bits) 1.5 seconds extended_burst = 2 * normal_burst
add multiple IPs, rate will be calculated for them together (not separately). For example if you want limit client with multiple IPs.
To delete IPs from the set:
If you want to always delete before add, but don't want to see deletion error message on console or dmesg, prepend delete command with '@':
Update rates for existing rules:
With this, if rule is not already exists then it will be added, if it's already exists then rate will be updated (with zero rate in example). Note, that IP list should match existing rule exactly.
To flush (clean) set named "name0" (i.e. delete all rules):
To view statistics:
Stat output example and format:
10.0.1.0/24 cir 1000000 cbs 187500 ebs 375000; tc 0 te 0 last never; conf 0/0 0 bps, rej 0/0
10.0.1.0/24 IPv4 network to match, cir 1000000 allowed rate (cir is committed information rate) in bits, cbs 187500 normal burst (cbs is committed burst size) in bytes, ebs 375000 extended burst (cbs is extended burst size) in bytes, tc 0 committed token bucket counter, te 0 extended token bucket counter (implementing extended burst), last never how much seconds ago last packet is seen, conf 0/0 0 bps conforming traffic counters (pkts/bytes bitrate), Note, that bps here is average bit rate estimation calculated for last several seconds. rej 0/0 rejected (or matched) traffic counters.
===========