I have been attempting to use nft/nftables
to blacklist ssh connections and have come across
two problems.
nftables-0.9.3-3.fc32.x86_64
kernel-5.7.8-200.fc32.x86_64
1. The "limit rate" syntax does not work correctly unless
the "burst" value is set.
counter add @saddr_rate { ip saddr timeout 2m limit rate over 4/minute burst 1 packets}
counter \
update @saddr_blacklist { ip saddr timeout 10m } counter drop
2. The following syntax is not accepted by nft
update @connection_count { ip saddr ct count over 3 } \
add @saddr_blacklist { ip saddr timeout 1m } drop
nft_harting.nft:80:3-52: Error: Could not process rule: Operation not supported
update @connection_count { ip saddr ct count over 3 } \
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I have been following a Debian mail list (amongst many)
https://unix.stackexchange.com/questions/581964/create-dynamic-blacklist-...
which implies that both of the above should work with the kernel/nft F32 versions
installed.
I attach the output of nft list ruleset
(with the offending rule "{ ip saddr ct count over 3 }" commented out)
(It includes the "set" definitions used above)
Can anyone see any deliberate mistakes?
John