Re: Question on rate limiting on nftables

[Gordon Fisher <gordfisherman@gmail.com>]

On 6/8/26 8:57 AM, Lars Noodén wrote:
> On 6/8/26 18:01, Andre Rodier wrote:
>> Also, a connection attempts on a
>> different port should immediately raise attention, as it is involving
>> more than a basic SSH scan bot.
>
> Shifting ports might quiet the logs somewhat, but your SSH port will 
> be found both quickly and easily by bots.  That has been the case for 
> a long time:
>
>  https://bsdly.blogspot.com/2013/02/theres-no-protection-in-high-ports.html 
>
>
> It is difficult to fit nftables into mitigations for those probes 
> because modern scans usually come from a wide spread of addresses and 
> networks.  In the case of SSH, using SSH keys (or even SSH 
> certificates) and turning off password authentication clears out a lot 
> of the bots, but that has been mentioned already.
>
You can just block access (drop) to all and only allow to specific 
address(es), then probes are taken out of the picture entirely.

-- 
gfish