debian - IPTables Rules Order -

I am trying to implement IPTable rules for traffic on port 443. I would like to adopt the new connection till they reach the rate limit, then drop them and log the dropped packets (I will add a limited rate for logging later). However, with my rules, my logging rule is called with every new connection. I do not want to enter a log entry, as long as the rate range is not already reached.

Regardless of the amount of Google search I made, I can not seem to understand this very basic question. I believe I understand that an ACCEPT rule will stop any rule after the call. But keeping my entry rules before or after the ACCEPT rule does not make any difference - the connection is still logged.

iptables -L -v -n INPUT for the series is as follows:

  Chain INPUT (Policy drop 2 packet, 88 bytes) PKT bytes target launch in Out source destination Choose 0 0 ACCEPT tcp - eth1 * 0.0.0.0.0 0.0.0.0.0 TCP DPT: 443 State new limit: Average 50 / minute burst 10 0 log TCP - at1 * 0.0.0.0.0 0.0.0.0/ 0 TCP DPT: 443 state new log flag 7 level 7 prefix "IPTable-50 / M-Depot:" 9 612 Accept all - related to the position of eth1 * 0.0.0.0.0 0.0.0.0/0, installed    
 
 
 You  -m limit  Will use the module.  
 
  iptables -t filter-ANPUT-P TCP-i et1 - - port 443 -m limit - minimum 10 / min -m state - station new, related, installed GET-ACCEPT   
  iptables -t filter -A INPUT -p tcp -i AT1 - Depot 443-M State --STAT New, Relatable, Astables - J LOG - -log-prefix "IPTables-443-Dropped:" --log-level 4   
  iptables -t Filters - an INPUT -p tcp -i eth1 --dport 443- M State --State New, Relatable, Establizet-J DROP    
 
 Packet reaching 10 lines per minute That will accept the first row.  
 The second row will match the match and bring the packet which will be 10 minutes per minute.  
 The third line will match the packet similar to the other rule and will leave.   
 I tried to do this with the ICMP packet only, and I do not know if you really want to use that method: this is a rate that you can do in Mandrup Better shut down using the said  -m connlimit  module:  
 
 Allows you to limit the number of parallel connections to the server per client's IP Address (or client address block).   
 Hope it helps.