Daniel Lakeland <dlakelan@xxxxxxxxxxxxxxxxxx> wrote: > I'm afraid I don't understand the rest of the email. Are you saying the only issue is that I need to declare it as an "over" quota? table inet filter { quota myq { over 10 mbytes } chain input { type filter hook input priority filter; policy accept; quota name "myq" drop } } Traffic comes to a screeching halt after ~10 mbytes, and resumes some time after 'nft reset quotas'.