{
int ret = 1;
- xt_xlate_add(xl, "flow table %s {", name);
+ xt_xlate_add(xl, "meter %s {", name);
ret = hashlimit_mode_xlate(xl, cfg->mode, family,
cfg->srcmask, cfg->dstmask);
if (cfg->expire != 1000)
const struct xt_hashlimit_info *info = (const void *)params->match->data;
int ret = 1;
- xt_xlate_add(xl, "flow table %s {", info->name);
+ xt_xlate_add(xl, "meter %s {", info->name);
ret = hashlimit_mode_xlate(xl, info->cfg.mode, NFPROTO_IPV4, 32, 32);
xt_xlate_add(xl, " timeout %us limit rate", info->cfg.expire / 1000);
print_packets_rate_xlate(xl, info->cfg.avg, 1);
iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW -j DROP
-nft add rule ip filter OUTPUT tcp dport 443 flow table https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new counter drop
+nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new counter drop
iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP
-nft add rule ip filter OUTPUT tcp dport 443 flow table https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop
+nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop