*filter
:CONNLIMIT-ABUSE -
# Drop 30% of TCP connections above 200 opened ones
#-A FORWARD -p tcp --syn -m connlimit -m statistic --mode nth --connlimit-above 200 --every 3 --packet 0 -j CONNLIMIT-ABUSE
# Drop everything above
#-A FORWARD -p tcp --syn -m connlimit --connlimit-above 250 -j CONNLIMIT-ABUSE

-A CONNLIMIT-ABUSE -m recent --update --seconds 600 -j DROP
-A CONNLIMIT-ABUSE -m recent --set -j LOG --log-prefix "<6> Connlimit-abuse: "
-A CONNLIMIT-ABUSE -j DROP

COMMIT
