Re: prefix len confusion

[Randy Bush <randy@psg.com>]

>> sorry for being insufficiently explicit
>>
>> the ssh attacker is getting through to 42.642.11.82, which is a piece of
>> hardware, not a vm.  it is the ssh port of a hardware switch whose
>> security profile i prefer not to expose to attackers.
>>
>>     define VULN4 = {
>> 	42.642.11.34/31,
>> 	42.642.11.36/31,
>> 	42.642.11.40/29,
>> 	42.642.11.48/29,
>> 	42.642.11.80/30   # <<<====
>>     }
>>
>>         ip daddr $VULN4 drop

> 
> In that case, the question becomes one of whether your nftables host
> is responsible for forwarding packets to "42.642.11.82" (as you put
> it) at all. And, just as importantly, from which source address.

the nftables is on the border router.  and traceroute showed the path
in.

the sources of the attacks are a ddos, /82 logs the ssh attack as from a
jillion source addresses.

> Try incorporating the following table into your existing ruleset.
> 
> table ip raw {
>     chain PREROUTING {
>         type filter hook prerouting priority raw;
>         ip daddr 42.642.11.82 tcp dport 22 meta nftrace set 1
>     }
> }
> 
> 
> Next, run "nft monitor trace".

sure, if only because i will learn a new hack :)

> If you do see output, study it, for it will conclusively show how the
> packets traverse your ruleset and why they are being accepted.

that would be lovely!!

thank you.  will report back.

randy