Limits - Revision history

Fmyhr: /* Declaring and using named limits */ Add optional text comment attribute.

2021-11-01T17:46:44Z

Declaring and using named limits: Add optional text comment attribute.

← Older revision		Revision as of 17:46, 1 November 2021
Line 15:		Line 15:
	table inet limit_demo {		table inet limit_demo {

	limit lim_400ppm { rate 400/minute }		limit lim_400ppm { rate 400/minute ; comment "use to limit incoming icmp" ; }
	limit lim_1kbps { rate over 1024 bytes/second burst 512 bytes }		limit lim_1kbps { rate over 1024 bytes/second burst 512 bytes ; comment "use to limit incoming smtp" ; }

	chain IN {		chain IN {
Line 31:		Line 31:
	* Accept traffic to port tcp/25 (smtp), up to a maximum rate of 1024 bytes / second. Up to 512 bytes of such traffic arriving faster than this is accepted.		* Accept traffic to port tcp/25 (smtp), up to a maximum rate of 1024 bytes / second. Up to 512 bytes of such traffic arriving faster than this is accepted.
	* Drop all other traffic.		* Drop all other traffic.
			The optional ''comment'' attribute requires at least nftables 0.9.7 and kernel 5.10.

	== Listing named limits ==		== Listing named limits ==

Fmyhr: Added named limit example.

2021-04-07T16:57:42Z

Added named limit example.

@@ Line 10: / Line 10: @@
 = Named limits =
-'''FIXME: Need at least one example here!'''
+== Declaring and using named limits ==
 == Listing named limits ==

Fmyhr: Initial stub page for named limits.

2021-04-06T21:15:44Z

Initial stub page for named limits.

New page

A limit uses a [https://en.wikipedia.org/wiki/Token_bucket token bucket] filter to match packets:

* only until its rate is exceeded; or
* only after its rate is exceeded, if defined as an ''over'' limit.

= [[Rate_limiting_matchings|Anonymous limits]] =

= Named limits =

'''FIXME: Need at least one example here!'''

== Declaring and using named limits ==

== Listing named limits ==

''nft list [limit | limits]'' (as per below) returns the limit(s) with current byte count.

* List a particular limit:
<source>
% nft list limit [family] [table_name] [limit_name]
</source>

* List all limits in a particular table:
<source>
% nft list limits table [family] [table_name]
</source>

* List all limits in ruleset:
<source>
% nft list limits
</source>