IPTables Rate Limit Modifier

A utility script to identify and modify the hitcount parameter in iptables rate limit rules. This tool is designed to prevent rate limiting from affecting legitimate traffic while maintaining protection against malicious activity.

Note: This script was almost entirely written using aider, an AI pair programming tool.

Background

This tool was created to address a specific limitation in UFW (Uncomplicated Firewall): UFW doesn't provide a way to adjust the hitcount parameters in its rate-limiting rules. While UFW simplifies firewall management, this limitation can lead to overly aggressive rate limiting for legitimate users.

The script allows you to:

• Identify rules using the --hitcount parameter
• Increase the hitcount threshold for rules below a specified value
• Maintain a safe balance between security and usability

Features

• Automatic backup of iptables rules before modification
• Dry run mode to show potential changes without applying them
• Comprehensive logging of all activities
• Safe error handling with automatic rollback to original rules

Requirements

• Python 3.6+
• Root privileges (required to modify iptables rules)
• Python packages: fire

Installation

# Clone the repository
git clone https://github.com/TODO/iptables-rate-limit-modifier.git
cd iptables-rate-limit-modifier
# Install dependencies
pip install fire

Usage

# Basic usage (requires root privileges)
sudo python iptables_rate_limit_modifier.py
# Run in dry mode (no changes)
sudo python iptables_rate_limit_modifier.py --dry
# Enable verbose logging to stdout
sudo python iptables_rate_limit_modifier.py --verbose

SystemD Integration

This utility includes SystemD service and timer files for automated execution:

# Install the service and timer files
sudo cp iptables-rate-limit-modifier.service /etc/systemd/system/
sudo cp iptables-rate-limit-modifier.timer /etc/systemd/system/
# Edit the service file to set the correct path to your script
sudo vim /etc/systemd/system/iptables-rate-limit-modifier.service
# Reload systemd configuration
sudo systemctl daemon-reload
# Enable and start the timer
sudo systemctl enable iptables-rate-limit-modifier.timer
sudo systemctl start iptables-rate-limit-modifier.timer

The timer is configured to run:

• 30 seconds after boot
• 5 minutes after boot (second check)
• Every hour after that

You can check the status with:

sudo systemctl status iptables-rate-limit-modifier.timer
sudo systemctl status iptables-rate-limit-modifier.service

How It Works

1. The script identifies all iptables rules that use the --hitcount parameter
2. It locates rules where the hitcount value is below a specified threshold (default: 10)
3. For identified rules, it increases the hitcount value to a higher threshold (default: 20)
4. A backup of the original rules is created before any changes are made

Configuration

Edit the top section of the script to change these default parameters:

• LOG_FILE: Location for log output
• HITCOUNT_THRESHOLD: Rules with hitcount below this value will be modified
• NEW_HITCOUNT_VALUE: The new hitcount value to apply

Safety Features

• Automatic backup of iptables rules before modification
• Validation of backups before applying changes
• Automatic restoration of original rules on error

License

This project is licensed under the AGPLv3 - see LICENSE for details.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.