--- a/snapshot_web.pp	2018-12-06 16:52:02.000000000 -0800
+++ b/snapshot_web.pp	2018-12-06 17:07:32.000000000 -0800
@@ -25,7 +25,21 @@
 	#  51.15.215.91
 	@ferm::rule { 'dsa-snapshot-abusers':
 		prio  => "005",
-		rule  => "saddr (61.69.254.110 18.128.0.0/9 3.120.0.0/14 35.156.0.0/14 52.58.0.0/15 99.137.191.34 51.15.215.91) DROP",
+		rule  => "saddr (61.69.254.110 99.137.191.34 51.15.215.91) DROP",
+	}
+	@ferm::rule { 'dsa-http-limit':
+		prio        => '20',
+		description => 'limit HTTP DOS',
+		chain       => 'http_limit',
+		domain      => '(ip ip6)',
+		rule        => 'mod limit limit-burst 60 limit 15/minute jump ACCEPT;
+		                jump DROP'
+	}
+	@ferm::rule { 'dsa-snapshot-ratelimit':
+		prio        => '21',
+		domain      => '(ip ip6)',
+		rule        => 'mod connlimit connlimit-above 2 connlimit-mask 21 jump DROP;
+		                jump http_limit'
 	}

 	ensure_packages ( [