>Дополнение, ограничить одновременных коннектов с одного IP

man iptables

>   connlimit
>       Allows you to restrict the number of  parallel  TCP  connections  to  a
>       server per client IP address (or address block).
>
>       [!] --connlimit-above n
>              match if the number of existing tcp connections is (not) above n
>
>       --connlimit-mask bits
>              group hosts using mask
>
>       Examples:
>
>       # allow 2 telnet connections per client host
>              iptables -p tcp --syn --dport 23 -m connlimit  --connlimit-above
>              2 -j REJECT
>
>       # you can also match the other way around:
>              iptables  -p  tcp  --syn  --dport 23 -m connlimit ! --connlimit-
>              above 2 -j ACCEPT
>
>       # limit the nr of parallel http requests to 16 per class C  sized  net-
>       work (24 bit netmask)
>              iptables -p tcp --syn --dport 80 -m connlimit  --connlimit-above
>              16 --connlimit-mask 24 -j REJECT