Viyurz/vps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[nftables] Add blackholes counters

Browse source
This commit is contained in:
Viyurz 2024-09-21 12:29:48 +02:00
parent e6fce28ee0
commit 9c7ad280f9
Signed by: Viyurz
SSH key fingerprint: SHA256:IskOHTmhHSJIvAt04N6aaxd5SZCVWW1Guf9tEcxIMj8
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
roles/nftables/templates/nftables.conf
View file

@ -41,15 +41,15 @@ table inet filter {
# Rate limiting # Rate limiting
meta nfproto ipv4 meter ratelimit4 \ meta nfproto ipv4 meter ratelimit4 \
{ ip saddr limit rate over 75/second burst 15 packets } \ { ip saddr limit rate over 75/second burst 15 packets } \
add @blackhole_ipv4 { ip saddr } add @blackhole_ipv4 { ip saddr } counter
meta nfproto ipv6 meter ratelimit6 \ meta nfproto ipv6 meter ratelimit6 \
{ ip6 saddr limit rate over 75/second burst 15 packets } \ { ip6 saddr limit rate over 75/second burst 15 packets } \
add @blackhole_ipv6 { ip6 saddr } add @blackhole_ipv6 { ip6 saddr } counter
# Max concurrent connections # Max concurrent connections
meta nfproto ipv4 meter connlimit4 \ meta nfproto ipv4 meter connlimit4 \
{ ip saddr ct count over 100 } add @blackhole_ipv4 { ip saddr } { ip saddr ct count over 100 } add @blackhole_ipv4 { ip saddr } counter
meta nfproto ipv6 meter connlimit6 \ meta nfproto ipv6 meter connlimit6 \
{ ip6 saddr ct count over 100 } add @blackhole_ipv6 { ip6 saddr } { ip6 saddr ct count over 100 } add @blackhole_ipv6 { ip6 saddr } counter
# Allow ICMP # Allow ICMP
meta l4proto icmp accept meta l4proto icmp accept