From: "Kamil Jońca" <kjonca@op.pl>
To: netfilter@vger.kernel.org
Subject: how to use meters?
Date: Sun, 18 Sep 2022 12:49:34 +0200 [thread overview]
Message-ID: <871qs9neip.fsf@alfa.kjonca> (raw)
I try to understand "meters" and I have an impression I missed
something.
Use case:
--8<---------------cut here---------------start------------->8---
iptables -A wan-f-ssh -p tcp -m conntrack --ctstate ESTABLISHED -m tcp --tcp-flags FIN,ACK FIN,ACK -m recent --set --name ssh --rsource -j LOG --log-prefix "FW+SSH:FIN:"
iptables -A wan-f-ssh -p tcp -m conntrack --ctstate ESTABLISHED -m tcp --tcp-flags FIN,ACK FIN,ACK -m recent --update --seconds 30 --hitcount 2 --name ssh --rsource -m recent --set --name ssh2 --rsource -j LOG --log-prefix "FW+SSH:FIN#2:"
iptables -A wan-f-ssh -j ACCEPT
[...]
iptables -A FORWARD -m recent --update --seconds 60 --name ssh2 --rsource -j DROP
iptables -A FORWARD -p tcp -m tcp --dport 22 -j wan-f-ssh
--8<---------------cut here---------------end--------------->8---
ie. if SSH connection ends, it added to observation (ssh set) then if
second end happens during 30 sec it is added to block (ssh2 set)
I would achieve similar behavior with nftables and I guess that I should
use meters but ... I do not know how.
In some internet sites I found some examples but I do not understand
"why that".
For example:
https://wiki.archlinux.org/title/Nftables#Dynamic_blackhole
--8<---------------cut here---------------start------------->8---
ct state new tcp dport 443 \
meter flood size 128000 { ip saddr timeout 10s limit rate over 10/second } \
add @blackhole { ip saddr timeout 1m }
--8<---------------cut here---------------end--------------->8---
I understand " add @blackhole { ip saddr timeout 1m }" - adds address to
set for 1 min.
but what is
"meter flood size 128000 { ip saddr timeout 10s limit rate over 10/second }"
(I can guess but I cannot see proper doc of this)
Any hint?
KJ
--
http://stopstopnop.pl/stop_stopnop.pl_o_nas.html
next reply other threads:[~2022-09-18 10:49 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-18 10:49 Kamil Jońca [this message]
2022-09-19 8:47 ` how to use meters? Pablo Neira Ayuso
2022-09-19 10:00 ` Kamil Jońca
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871qs9neip.fsf@alfa.kjonca \
--to=kjonca@op.pl \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.