On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> In the below example it does not print any logs and since that stanza is
> right prior drop I reckon that since the log printing does not happen the
> frame dropping does neither.
>
> table inet filter {
[...]
> chain wan_pr {
> ct state { new } update @glv4 { ip saddr limit rate over
> 15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
> }
> }
ct state new is restricting to match only on the first packet of the
connection.
