*filter
:CONNLIMIT-ABUSE -

# Drop 30% of TCP connections above 2000 opened ones
-A FORWARD -p tcp --syn -m connlimit -m statistic --mode nth --connlimit-above 2000 --every 3 --packet 0 -j CONNLIMIT-ABUSE
# Drop everything above
-A FORWARD -p tcp --syn -m connlimit --connlimit-above 2500 -j CONNLIMIT-ABUSE

-A CONNLIMIT-ABUSE -m recent --update --seconds 600 -j DROP
-A CONNLIMIT-ABUSE -m recent --set -j LOG --log-prefix "<6> Connlimit-abuse: "
-A CONNLIMIT-ABUSE -j DROP

COMMIT
