Hello
I have got a question about rate limiting. My configuration is not
working as expected. After 14 packets drop from rule 3 counter rule 2 is
triggering but it is configured to be triggered after 30 packets per
minute. I am further confused when I change to 25/minute the same count
of 14 packets is dropped by rule 3 and then rule 2 trigger. What is wrong ?
(...)
#Section with problem:
type filter hook prerouting priority 0; policy accept;
1. ip saddr @banned counter drop
2. ct state invalid meter invalid size 300 { ip saddr limit rate over
30/minute} add @banned { ip saddr timeout 20m } counter drop
3. ct state invalid counter drop
(...)
Debian buster with kernel 4.19.12-1 and nftables 0.9.0-2
--
Best Regards
Grzegory
