Fix 0xC0368006 IPsec DoS rate limit queues error

You're setting up a VPN or IPsec tunnel between two Windows servers, or maybe connecting a remote client. Everything looks fine, but then you see this error pop up in the event log or in a command output: STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES (0xC0368006). It's a nasty one.

This error usually shows up when one specific IP address is sending IPsec traffic faster than the server expects. I've seen it on Windows Server 2019 and 2022, especially with VPN concentrators that handle many tunnels. The real trigger? One remote IP hits the per-IP queue limit. The DoS protection thinks it's an attack, and it drops packets.

Root cause explained

IPsec DoS protection is a feature in Windows. It's designed to stop a single machine from flooding your server with IPsec packets. It tracks how many packets each IP sends. If one IP sends too many, the server starts dropping those packets and logs this error. The default limit is often too low for busy VPN gateways.

So it's not a bug — it's a safety catch that's too tight. You need to loosen it or turn it off completely.

Fix: Change the per-IP rate limit queues

There are two ways to fix this. First try increasing the queue limit. If that doesn't work, you can disable the per-IP rate limit entirely.

Option 1: Increase the queue limit

Open Command Prompt as Administrator. Right-click Start > "Command Prompt (Admin)" or "Windows Terminal (Admin)".
Check the current IPsec DoS settings. Run:
```
netsh ipsec dynamic show all
```
After running, you'll see a section called "IPsec DoS Protection". Look for PerIPRateLimitQueues. Default is usually 10. That's the max queues per IP.
Increase it. For example, set it to 50:
```
netsh ipsec dynamic set config dosprotection PerIPRateLimitQueues=50
```
After you press Enter, you should see "Ok." no error.
Apply the change right away (no reboot needed):
```
netsh ipsec dynamic set config dosprotection State=enable
```
Wait a few seconds. Then test your VPN connection again.

Option 2: Disable per-IP rate limit (if option 1 doesn't work)

Sometimes increasing the queue isn't enough. Maybe you have a lot of traffic from one IP. Then just disable the per-IP limit.

Open Command Prompt as Administrator (same as above).
Turn off the per-IP rate limit:
```
netsh ipsec dynamic set config dosprotection PerIPRateLimitQueues=0
```
Setting it to 0 means unlimited queues per IP.
Make sure DoS protection stays on (global state):
```
netsh ipsec dynamic set config dosprotection State=enable
```
After this, run netsh ipsec dynamic show all again. You should see PerIPRateLimitQueues = 0.
Test the connection. The error should stop.

What if it still fails?

If you still get the error after changing the queue limit, check these things:

Reboot the server. Sometimes the netsh changes stick immediately, but on some systems a reboot makes them work better. I've seen a Windows Server 2019 that needed a restart even though Microsoft says it shouldn't.
Check the registry. The netsh commands write to this registry path: HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\DosProtection. Look for a DWORD named PerIPRateLimitQueues. If it's missing, the default is 10. You can set it there manually as a DWORD (decimal). Reboot after changing it.
Firmware updates. Some network drivers have their own IPsec offload features. If you're using a NIC from Intel or Mellanox, update the driver and firmware. Old drivers can mess with IPsec processing and make the error show up even with low traffic.
Check for multiple tunnels from the same IP. If the same remote IP is establishing many tunnels (like with site-to-site VPN), you might need to increase PerIPRateLimitQueues way higher (like 200 or 500). Run the same netsh command with a bigger number.

That's it. This fix has saved me hours of head-scratching on VPN servers. Don't overthink it — just crank up the queue or turn off the per-IP limit. The DoS protection for the whole system stays on, so you're still safe from floods.