On 28/09/2020 14:24, Pablo Neira Ayuso wrote:
On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
In the below example it does not print any logs and since that stanza is
right prior drop I reckon that since the log printing does not happen the
frame dropping does neither.
table inet filter {
[...]
chain wan_pr {
ct state { new } update @glv4 { ip saddr limit rate over
15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
}
}
ct state new is restricting to match only on the first packet of the
connection.
Right, it should be then rather something with ct count, like:
ct state new update @glv4 { ip saddr ct count over 15 } log flags all
prefix "glv4 DROP: " drop
but that produces:
Error: Could not process rule: Not supported
??
