Determining whether to rate limit traffic

A non-transitory machine-readable medium storing a gateway datapath program which when executed by at least one processing unit of a gateway device implements first and second logical routers for a set of logical networks and processes traffic between the set of logical networks and an external network, the gateway datapath program comprising sets of instructions for:

• receiving a plurality of data messages at the gateway device;
• to process each of a set of data messages, executing a set of processing stages comprising a processing stage for the first logical router or the second logical router;
• and
• as part of the processing stage for each of the first or second logical router:
• using a first or second access control list (ACL) table to determine whether each data message processed for the first or second logical router is subject to rate limiting controls defined for the first or second logical router;
• and
• only when the data message is subject to rate limiting controls, determining whether to allow the data message according to a rate limiting mechanism for the first or second logical router,
• the first ACL table associated with the first logical router and storing a first plurality of ACL rules for the first logical router and the second ACL table associated with the second logical router and storing a second plurality of ACL rules for the second logical router,
• at least two ACL rules in each table specifying two different rate limiting controls for two different data message flows processed by the processing stage of the table's associated logical router.