diff --git a/package/iptables/Makefile b/package/iptables/Makefile
index 87d898bea0..a401115de0 100644
--- a/package/iptables/Makefile
+++ b/package/iptables/Makefile
@@ -189,6 +189,17 @@ Includes:
 - libipt_ULOG
 endef
 
+define Package/iptables-mod-hashlimit
+$(call Package/iptables/Module, +kmod-ipt-hashlimit)
+  TITLE:=hashlimit matching
+endef
+
+define Package/iptables-mod-hashlimit/description
+iptables extensions for hashlimit matching
+Includes:
+- libxt_hashlimit
+endef
+
 define Package/iptables-mod-iprange
 $(call Package/iptables/Module, +kmod-ipt-iprange)
   TITLE:=IP range extension
@@ -394,6 +405,7 @@ $(eval $(call BuildPlugin,iptables-mod-nat,$(IPT_NAT-m)))
 $(eval $(call BuildPlugin,iptables-mod-nat-extra,$(IPT_NAT_EXTRA-m)))
 $(eval $(call BuildPlugin,iptables-mod-iprange,$(IPT_IPRANGE-m)))
 $(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
+$(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
 $(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
 $(eval $(call BuildPackage,ip6tables))
 $(eval $(call BuildPackage,ip6tables-utils))
diff --git a/package/kernel/modules/netfilter.mk b/package/kernel/modules/netfilter.mk
index 561286efda..510c195d62 100644
--- a/package/kernel/modules/netfilter.mk
+++ b/package/kernel/modules/netfilter.mk
@@ -512,3 +512,17 @@ define KernelPackage/nf-conntrack-netlink/description
 endef
 
 $(eval $(call KernelPackage,nf-conntrack-netlink))
+
+define KernelPackage/ipt-hashlimit
+$(call KernelPackage/ipt/Depends,)
+  TITLE:=Netfilter hashlimit match
+  FILES:=$(LINUX_DIR)/net/netfilter/xt_hashlimit.$(LINUX_KMOD_SUFFIX)
+  KCONFIG:=$(KCONFIG_IPT_HASHLIMIT)
+  AUTOLOAD:=$(call AutoLoad,50,xt_hashlimit)
+endef
+
+define KernelPackage/ipt-hashlimit/description
+ Kernel modules support for the hashlimit bucket match module
+endef
+
+$(eval $(call KernelPackage,ipt-hashlimit))