2

I use nftables to do rate limiting:

chain input: {
    type filter hook input priority 0; policy accept;
    tcp dport http ct state new jump rate-limit
}

chain rate-limit {
    meter httplimit4 { ip saddr limit rate 2/second burst 20 packets } counter accept
    drop
}

It works, until the list is full. For some reason, once an ip was seen, it stays in the list, even after the rate limiting has "recovered". How can I flush out old entries from the list?

Of course I could run a cron job with

nft flush meter inet filter httplimit4

periodically, but isn't there some way to tell nftables to drop entries from the table when the ip was not seen for some time?

router
  • 21
  • 1

0 Answers0