From mboxrd@z Thu Jan  1 00:00:00 1970
From: Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: rate limit not working ?
Date: Tue, 20 Sep 2016 10:13:41 +0200
Message-ID: <20160920081341.GA2328@salvia>
References: <a6f9f673-8c5b-4a95-ea38-4fb8b39d4dc8@c-s.fr>
Mime-Version: 1.0
Return-path: <netfilter-devel-owner@vger.kernel.org>
Content-Disposition: inline
In-Reply-To: <a6f9f673-8c5b-4a95-ea38-4fb8b39d4dc8@c-s.fr>
Sender: netfilter-devel-owner@vger.kernel.org
List-ID: <netfilter.vger.kernel.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: Christophe Leroy <christophe.leroy@c-s.fr>
Cc: netfilter@vger.kernel.org, netfilter-devel@vger.kernel.org

On Fri, Sep 16, 2016 at 06:50:22PM +0200, Christophe Leroy wrote:
> Hi
> 
> I tried to limit ping flooding by setting the following rule:
> 
> nft add rule filter input icmp type echo-request limit rate 10/second accept

This is matching packets under the rate, so packets under the rate are
accepted.

Your next rule, or default policy, should drop, so packets over the
rate are dropped.

You can invert this logic via:

 # nft add rule filter input icmp type echo-request limit rate over 10/second drop

Does this work for you?

Thanks.