On 28/09/2020 17:43, Pablo Neira Ayuso wrote:
On Mon, Sep 28, 2020 at 01:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
On 28/09/2020 14:24, Pablo Neira Ayuso wrote:
On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
In the below example it does not print any logs and since that stanza is
right prior drop I reckon that since the log printing does not happen the
frame dropping does neither.
table inet filter {
[...]
chain wan_pr {
ct state { new } update @glv4 { ip saddr limit rate over
15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
}
}
ct state new is restricting to match only on the first packet of the
connection.
Right, it should be then rather something with ct count, like:
ct state new update @glv4 { ip saddr ct count over 15 } log flags all prefix
"glv4 DROP: " drop
but that produces:
Error: Could not process rule: Not supported
What would you like to achieve in first place?
This thread is starting to diverge from the original question.
It is still about (rate) limiting offending saddrs with sets, probably
in a staged approach, say log and drop saddrs like
* ct state update @glv4 { new , invalid } count over 50 timeout 1s
* ct state update @glv4 { new , invalid } count over 75 timeout 1h
* ct state update @glv4 { new , invalid } count over 150 timeout 1d
similar to what been mentioned here
https://www.spinics.net/lists/netfilter/msg58506.html
where is is mentioned:
This example above also requires kernel >= 4.18
This node currently deploys kernel 5.9.0-rc7 and thus I am surprised
about the error printing not supported, also with log stanza removed
from the rule and add instead of update for the set handling.
