Re: meter directive

[Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>]

On Mon, Sep 28, 2020 at 06:26:04PM +0200, Devin Bayer wrote:
> 
> 
> On 28/09/2020 18.21, Pablo Neira Ayuso wrote:
> 
> > On Mon, Sep 28, 2020 at 06:12:21PM +0200, Devin Bayer wrote:
> 
> >>
> 
> >> How do I get the behavior like in the wiki, which uses maps?
> 
> >
> 
> > What example are you referring to?
> 
> 
> https://wiki.nftables.org/wiki-nftables/index.php/Meters
> 
> % nft list map my_filter_table my_ssh_meter
> 
> table ip my_filter_table {
> 	map my_ssh_meter {
> 		type ipv4_addr . inet_service
>               size 65535
> 		flags dynamic,timeout
> 
> 		elements = { 64.62.190.36 . 55000 expires 38s : counter packets 2 bytes
> 220, 83.98.201.47 . 35460 expires 39s : counter packets 10 bytes 5988,
> 172.217.7.142 . 43254 expires 46s : counter packets 1 bytes 98}
> 
> 	}
> 
> }

I just fixed this in the wiki.

For this example:

% nft add chain filter input {type filter hook input priority 0\;}
% nft add set filter ssh-meter { type ipv4_addr\; flags dynamic\; }
% nft add rule filter input tcp dport 22 ct state new add @ssh-meter { ip saddr limit rate 10/second } accept

The listing is:

% nft list set my_filter_table my_ssh_meter
table ip my_filter_table {
        set my_ssh_meter {
                type ipv4_addr
                size 65535
                flags dynamic
                elements = { 10.141.10.2 limit rate 10/second }
        }
}