*filter
:CONNLIMIT-ABUSE -
# Drop 30% of TCP connections above 200 opened ones
-A FORWARD -p tcp --syn -m connlimit -m nth --connlimit-above 200 --every 3 -j CONNLIMIT-ABUSE
# Drop everything above
-A FORWARD -p tcp --syn -m connlimit --connlimit-above 250 -j CONNLIMIT-ABUSE

#-A CONNLIMIT-ABUSE -m recent --update --seconds 600 -j DROP
#-A CONNLIMIT-ABUSE -m recent --set -j LOG --log-prefix "<6> Connlimit-abuse: "
-A CONNLIMIT-ABUSE -j DROP

COMMIT
