Connlimits - Revision history

Pablo: /* Using connlimits in dynamic sets and maps */ remove this example, the header is a hyperlink

2021-07-05T20:35:38Z

Using connlimits in dynamic sets and maps: remove this example, the header is a hyperlink

← Older revision		Revision as of 20:35, 5 July 2021
Line 28:		Line 28:

	= [[Meters#Doing_connlimit_with_nft\|Using connlimits in dynamic sets and maps]] =		= [[Meters#Doing_connlimit_with_nft\|Using connlimits in dynamic sets and maps]] =

	~~You can also use connlimit in dynamic sets, this provides a scalable way to define connlimits per set element.~~

	~~The following example shows how to allow up to 2 simultaneous connections to your host from one IP address.~~

	~~<source lang="bash">~~
	~~table ip filter {~~
	~~set connlimit {~~
	~~type ipv4_addr~~
	~~flags dynamic~~
	}

	~~chain input {~~
	~~type filter hook input priority filter; policy accept;~~
	~~ct state new add @connlimit { ip saddr ct count over 2 } counter drop~~
	}
	}
	~~</source>~~

	~~Caveats:~~
	* Do not define a set with a timeout. There is a garbage collector that removes the set element whenever ''ct count'' becomes zero to improve memory usage.
	* For the same reason, you cannot use the ''update'' set statement which allows to refresh the timeout of your set element. Therefore, the ''ct count'' statement can only be used with the ''add'' set statement.

	~~If you define a set with a timeout or you use the ''update'' set statement, then you will hit the "Operation is not supported" error.~~

Pablo: /* Using connlimits in dynamic sets and maps */ add example and caveats

2021-07-05T20:34:30Z

Using connlimits in dynamic sets and maps: add example and caveats

← Older revision		Revision as of 20:34, 5 July 2021
Line 42:		Line 42:
	chain input {		chain input {
	type filter hook input priority filter; policy accept;		type filter hook input priority filter; policy accept;
	ct state new add @connlimit { ip saddr ct count over 2 } counter ~~packets 6 bytes 504~~ drop		ct state new add @connlimit { ip saddr ct count over 2 } counter drop
	}		}
	}		}

Pablo: /* Using connlimits in dynamic sets and maps */ add example and caveats

2021-07-05T20:29:52Z

Using connlimits in dynamic sets and maps: add example and caveats

← Older revision		Revision as of 20:29, 5 July 2021
Line 28:		Line 28:

	= [[Meters#Doing_connlimit_with_nft\|Using connlimits in dynamic sets and maps]] =		= [[Meters#Doing_connlimit_with_nft\|Using connlimits in dynamic sets and maps]] =

			You can also use connlimit in dynamic sets, this provides a scalable way to define connlimits per set element.

			The following example shows how to allow up to 2 simultaneous connections to your host from one IP address.

			<source lang="bash">
			table ip filter {
			set connlimit {
			type ipv4_addr
			flags dynamic
			}

			chain input {
			type filter hook input priority filter; policy accept;
			ct state new add @connlimit { ip saddr ct count over 2 } counter packets 6 bytes 504 drop
			}
			}
			</source>

			Caveats:
			* Do not define a set with a timeout. There is a garbage collector that removes the set element whenever ''ct count'' becomes zero to improve memory usage.
			* For the same reason, you cannot use the ''update'' set statement which allows to refresh the timeout of your set element. Therefore, the ''ct count'' statement can only be used with the ''add'' set statement.

			If you define a set with a timeout or you use the ''update'' set statement, then you will hit the "Operation is not supported" error.

Fmyhr: plural connlimits in section headers

2021-04-07T15:26:12Z

plural connlimits in section headers

← Older revision		Revision as of 15:26, 7 April 2021
Line 13:		Line 13:
	'''Note''': connlimits require at least nftables 0.9.0 and Linux kernel 4.19.10; using connlimits can crash the host when using earlier 4.19.x kernels.		'''Note''': connlimits require at least nftables 0.9.0 and Linux kernel 4.19.10; using connlimits can crash the host when using earlier 4.19.x kernels.

	= Using ~~connlimit~~ in rules =		= Using connlimits in rules =

	<source>		<source>
Line 27:		Line 27:
	The above ruleset accepts packets to port tcp/22 (sshd), as long as conntrack is currently tracking no more than 10 such sshd connections. If a new SYN to tcp/22 arrives while conntrack already has 10 such connections, it will be dropped.		The above ruleset accepts packets to port tcp/22 (sshd), as long as conntrack is currently tracking no more than 10 such sshd connections. If a new SYN to tcp/22 arrives while conntrack already has 10 such connections, it will be dropped.

	= [[Meters#Doing_connlimit_with_nft\|Using ~~connlimit~~ in dynamic sets and maps]] =		= [[Meters#Doing_connlimit_with_nft\|Using connlimits in dynamic sets and maps]] =

Fmyhr: Initial connlimits page.

2021-04-07T15:25:04Z

Initial connlimits page.

New page

A connlimit in nftables is written ''ct count {over}'' [count]. Unlike other stateful object types, all connlimits are anonymous: each connlimit attaches to and applies within the context of a single rule or single element of a dynamic set or map.

A connlimit ''ct count {over}'' [count]:
<ol>
<li>counts the number of current conntrack connections matching its context;</li>
<li>matches either:
<ol style="list-style-type:lower-alpha">
<li>only when conntrack is currently tracking fewer than ''count'' matching connections, or</li>
<li>if ''over'' is specified, only when conntrack is currently tracking more than ''count'' matching connections.</li>
</ol>
</ol>

'''Note''': connlimits require at least nftables 0.9.0 and Linux kernel 4.19.10; using connlimits can crash the host when using earlier 4.19.x kernels.

= Using connlimit in rules =

<source>
table inet connlimit_demo {
chain IN {
type filter hook input priority filter; policy drop;

tcp dport 22 ct count 10 accept
}
}
</source>

The above ruleset accepts packets to port tcp/22 (sshd), as long as conntrack is currently tracking no more than 10 such sshd connections. If a new SYN to tcp/22 arrives while conntrack already has 10 such connections, it will be dropped.

= [[Meters#Doing_connlimit_with_nft|Using connlimit in dynamic sets and maps]] =