Re: [nftables] netdev rate limiting | timeouts rfq

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Sep 28, 2020 at 04:03:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> 
> On 28/09/2020 17:43, Pablo Neira Ayuso wrote:
> > On Mon, Sep 28, 2020 at 01:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > On 28/09/2020 14:24, Pablo Neira Ayuso wrote:
> > > > On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > > > In the below example it does not print any logs and since that stanza is
> > > > > right prior drop I reckon that since the log printing does not happen the
> > > > > frame dropping does neither.
> > > > > 
> > > > > table inet filter {
> > > > [...]
> > > > >           chain wan_pr {
> > > > >                   ct state { new } update @glv4 { ip saddr limit rate over
> > > > > 15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
> > > > >           }
> > > > > }
> > > > ct state new is restricting to match only on the first packet of the
> > > > connection.
> > > Right, it should be then rather something with ct count, like:
> > > 
> > > ct state new update @glv4 { ip saddr ct count over 15 } log flags all prefix
> > > "glv4 DROP: " drop
> > > 
> > > but that produces:
> > > 
> > > Error: Could not process rule: Not supported
> > What would you like to achieve in first place?
> > 
> > This thread is starting to diverge from the original question.
> 
> It is still about (rate) limiting offending saddrs with sets, probably in a
> staged approach, say log and drop saddrs like
> 
> * ct state update @glv4 { new , invalid } count over 50 timeout 1s
> * ct state update @glv4 { new , invalid } count over 75 timeout 1h
> * ct state update @glv4 { new , invalid } count over 150 timeout 1d

Sorry I don't understand what you're trying to express with this
syntax.