未验证成功

firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp --dport 22 -m state --state NEW -m recent --set
firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 1 -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 30 --hitcount 6 -j REJECT --reject-with tcp-reset

推荐方法，已验证成功

iptables -A INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 50 -j REJECT
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 50 -j REJECT

压力测试 apache 进程数良好

ab -c 49 -n 9999 http://www.test.com/

备注

iptables -L -n --line-number 查看所有规则，并显示行号
iptables -D INPUT 3  //删除input的第3条规则 

参考：

https://github.com/firewalld/firewalld/issues/70

https://serverfault.com/questions/683671/is-there-a-way-to-rate-limit-connection-attempts-with-firewalld/683752#683752

https://www.tecmint.com/linux-iptables-firewall-rules-examples-commands/

http://httpd.apache.org/docs/current/misc/security_tips.html

https://blog.csdn.net/xfks55/article/details/50148389