At first I overlooked the "drop". Putting it on a separate line makes it
more visible and also details the separate steps of this rule.
Signed-off-by: Simon Ruderich <simon@ruderich.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
# requests occurred per second and ip address.
nft add rule ip filter input tcp flags syn tcp dport ssh \
add @flood { ip saddr limit rate over 10/second } \
- add @blackhole { ip saddr } drop
+ add @blackhole { ip saddr } \
+ drop
# inspect state of the sets.
nft list set ip filter flood