Score:0

Migrating iptables "recent" module to nftables

cn flag

I'm looking for some help migrating some old iptables rules onto a system that is only using nftables.

iptables rules:

iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 30 --hitcount 10 --name test --mask 255.255.255.255 --rsource -j DROP
iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --set --name test --mask 255.255.255.255 --rsource

The nftables wiki suggests using Sets however I can't see how to apply --hitcount 10. The goal for this rule is to block SSH traffic per source address after 10 connections in a 30 second period.

Lobz avatar
cn flag
Please see a very similar thread: https://stackoverflow.com/questions/67765358/nftables-rate-limiting-per-multiple-seconds
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.