Thank you for helping and fast reply.
When i include burst in my ruleset it works as expected with burst. I
simulate this with nmap --bad-sum but when there is no burst e.g delay
between packets is 1s
nmap --bad-sum --scan-delay 1s
behavior is very strange because it drops 60 packets instead of 30. How
to explain this ?
ct state invalid meter invalid size 300 { ip saddr limit rate over
30/minute burst 30 packets} add @banned { ip saddr timeout 20m }
counter packets 1 bytes 44 drop
ct state invalid counter packets 60 bytes 2640 drop
On 05.01.2019 16:53, Florian Westphal wrote:
GM <grzesiek20@xxxxxx> wrote:
I have got a question about rate limiting. My configuration is not working
as expected. After 14 packets drop from rule 3 counter rule 2 is triggering
but it is configured to be triggered after 30 packets per minute. I am
further confused when I change to 25/minute the same count of 14 packets is
dropped by rule 3 and then rule 2 trigger. What is wrong ?
(...)
#Section with problem:
type filter hook prerouting priority 0; policy accept;
1. ip saddr @banned counter drop
2. ct state invalid meter invalid size 300 { ip saddr limit rate over
30/minute} add @banned { ip saddr timeout 20m } counter drop
Does it work if you use 'burst 30'
("rate over 30/minute burst 30 packets")?
--
Pozdrawiam
Grzesiek M.
