On Wed, Dec 02, 2015 at 11:43:01PM +0100, Robert Sander wrote:
> Hi,
>
> How do I implement something like this in nftables:
>
> iptables -A INPUT -m conntrack --ctstate INVALID -m limit --limit 3/m --limit-burst 5 -j LOG --log-level debug --log-prefix "INVALID DROP: "
> iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
The translation is:
nft add rule filter input ct state invalid \
limit rate 3/minute burst 5 packets \
log level debug prefix \"INVALID DROP: \" counter
nft add rule filter input ct state invalid counter drop
Note that rule counters are optional in nftables, unlikely iptables
where we always have them on.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
