Some additional information: the error is reproducible with debian kernel 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) x86_64 However with older kernel releases (I've tried custom build 4.4.32) iptables command does not error out and hashlimit seems to work fine.