Re: Nftables ct count over 2 counter continues to trigger with only 1 connection

[Florian Westphal <fw@strlen.de>]

louis.t42@caramail.com <louis.t42@caramail.com> wrote:
> I have read the documentation and asked on Stack Exchange but am unable to find an answer to the following behavior.
> 
> Given this table and chain where 123.123.123.123 is my own address:
> 
> table ip mytable {
>         chain mychain {
>                 type filter hook input priority filter; policy accept;
>                 ip saddr != 123.123.123.123 drop
>                 ip saddr 123.123.123.123 ct count over 2 counter
>         }
> }

After looking at Fernandos analysis, does this work when you restrict
this to new packets, i.e.:

	ct state new jump {
		ip saddr != 123.123.123.123 drop
		ip saddr 123.123.123.123 ct count over 2 counter
	}

This is supposed to only ever add new connections and not re-add established
ones.