On 28/09/2020 18:23, Pablo Neira Ayuso wrote:
On Mon, Sep 28, 2020 at 04:03:00PM +0000, ѽ҉ᶬḳ℠ wrote:
On 28/09/2020 17:43, Pablo Neira Ayuso wrote:
On Mon, Sep 28, 2020 at 01:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
On 28/09/2020 14:24, Pablo Neira Ayuso wrote:
On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
In the below example it does not print any logs and since that stanza is
right prior drop I reckon that since the log printing does not happen the
frame dropping does neither.
table inet filter {
[...]
chain wan_pr {
ct state { new } update @glv4 { ip saddr limit rate over
15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
}
}
ct state new is restricting to match only on the first packet of the
connection.
Right, it should be then rather something with ct count, like:
ct state new update @glv4 { ip saddr ct count over 15 } log flags all prefix
"glv4 DROP: " drop
but that produces:
Error: Could not process rule: Not supported
What would you like to achieve in first place?
This thread is starting to diverge from the original question.
It is still about (rate) limiting offending saddrs with sets, probably in a
staged approach, say log and drop saddrs like
* ct state update @glv4 { new , invalid } count over 50 timeout 1s
* ct state update @glv4 { new , invalid } count over 75 timeout 1h
* ct state update @glv4 { new , invalid } count over 150 timeout 1d
Sorry I don't understand what you're trying to express with this
syntax.
To get a flexible evaluation period for the count value:
* ct state { new , invalid } update @glv4 { ip saddr ct count over 50
timeout 1s } log flags all prefix "glv4 DROP: " drop
update set element for any saddr that exceeds the count of 50 within 1 s
for ct state new | invalid
* ct state { new , invalid } update @glv4 { ip saddr ct count over 75
timeout 1s } log flags all prefix "glv4 DROP: " drop
update set element for any saddr that exceeds the count of 75 within 1 h
for ct state new | invalid
* ct state { new , invalid } update @glv4 { ip saddr ct count over 75
timeout 1s } log flags all prefix "glv4 DROP: " drop
update set element for any saddr that exceeds the count of 150 within 1
d for ct state new | invalid
