root@harting:~]$ nft list ruleset table ip ja_harting { set saddr_blacklist { type ipv4_addr size 65536 flags dynamic,timeout timeout 10m } set saddr_rate { type ipv4_addr size 65536 flags dynamic,timeout timeout 1m } set connection_count { type ipv4_addr size 65536 flags dynamic } chain SSH_IN { ip saddr @saddr_blacklist update @saddr_blacklist { ip saddr timeout 1m } counter packets 1 bytes 60 drop counter packets 4 bytes 240 add @saddr_rate { ip saddr timeout 2m limit rate over 4/minute burst 1 packets } counter packets 1 bytes 60 update @saddr_blacklist { ip saddr timeout 10m } counter packets 1 bytes 60 drop ct state invalid drop counter packets 3 bytes 180 accept } chain filter_INPUT { type filter hook input priority filter + 10; policy accept; iifname "lo" counter packets 26 bytes 2847 accept comment "white list local connections, established or not" tcp dport 22 ct state new counter packets 5 bytes 300 goto SSH_IN comment "This does not return!" tcp dport 22 counter packets 24886 bytes 1305859 ct state { invalid } drop ct state { established, related } counter packets 366030 bytes 270962493 accept udp dport 631 ct state { new, untracked } counter packets 2397 bytes 804593 accept comment "CUPS" udp dport 8612 ct state { new, untracked } counter packets 0 bytes 0 accept comment "Canon bonjour port" reject with icmp type admin-prohibited } chain filter_FORWARD { type filter hook forward priority filter + 10; policy drop; reject with icmp type admin-prohibited } chain filter_OUTPUT { type filter hook output priority filter + 10; policy accept; } } table netdev filter { chain ingress { type filter hook ingress device "eth0" priority filter; policy accept; meta protocol { 0x7374, 0x7380, 0x7475, 0x7679, 0x8137, 0x8138 } counter packets 13136 bytes 629558 drop } }