IPTables rate limit per destination IP and port
<p>I currently have these rules:</p>

<pre><code>iptables -I FORWARD -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0&gt;&gt;22&amp;0x3C@8=0xFFFFFFFF' -j SRCDS-TRF
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0&gt;&gt;22&amp;0x3C@10&amp;0xFFFF=0x5453' -m limit --limit 45/second --limit-burst 150 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0&gt;&gt;22&amp;0x3C@9&amp;0xFF=0x55' -m limit --limit 3/second --limit-burst 20 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} -m u32 --u32 '0&gt;&gt;22&amp;0x3C@9&amp;0xFF=0x56' -m limit --limit 3/second --limit-burst 15 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} --sport 27005 -m u32 --u32 '0&gt;&gt;22&amp;0x3C@9&amp;0xFF=0x71' -m limit --limit 20/second --limit-burst 70 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} ! --sport 27005 -m u32 --u32 '0&gt;&gt;22&amp;0x3C@9&amp;0xFF=0x71' -m limit --limit 2/second --limit-burst 17 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} --sport 27005 -m u32 --u32 '0&gt;&gt;22&amp;0x3C@9&amp;0xFF=0x6b' -m limit --limit 20/second --limit-burst 70 -j ACCEPT
iptables -I SRCDS-TRF -p udp -d {IPDST} --dport {PORTDST} ! --sport 27005 -m u32 --u32 '0&gt;&gt;22&amp;0x3C@9&amp;0xFF=0x6b' -m limit --limit 2/second --limit-burst 17 -j ACCEPT
</code></pre>

<p>This works, however I'm having to create many of these rules per IP and Port. If I don't supply a IP Destination and Port Destination it acts as a packet limit overall rather than per IP, this causes issues when one application gets a spike in traffic and the rest of them get rate-limited also.</p>

<p>Is there an easier way of creating just one set of rules, instead of potentially having hundreds?</p>