Meters - Revision history

Pablo: /* Dynamic set and map and stateful expressions */ minor edit

2023-08-15T21:58:54Z

Dynamic set and map and stateful expressions: minor edit

← Older revision		Revision as of 21:58, 15 August 2023
Line 1:		Line 1:
	== Dynamic set ~~and~~ map and stateful expressions ==		== Dynamic set/map and stateful expressions ==

	If you specify the ''dynamic'' flag to your set/map declaration, you can add elements to your set/map from the packet path. You can also attach a ratelimit per byte/packet/connection, counter and quota to such elements.		If you specify the ''dynamic'' flag to your set/map declaration, you can add elements to your set/map from the packet path. You can also attach a ratelimit per byte/packet/connection, counter and quota to such elements.

Pablo: clarify dynamic flag

2023-08-15T21:58:12Z

clarify dynamic flag

← Older revision		Revision as of 21:58, 15 August 2023
Line 1:		Line 1:
	== ~~Meters~~ ==		== Dynamic set and map and stateful expressions ==

	'''~~Dynamic sets/maps~~'~~'' allow~~ to add elements to ~~the~~ set/map from the packet path ~~and to~~ attach ratelimit per byte/packet/connection, counter and quota to such elements.		If you specify the ''dynamic'' flag to your set/map declaration, you can add elements to your set/map from the packet path. You can also attach a ratelimit per byte/packet/connection, counter and quota to such elements.

	Among other things, ~~they~~ provide a lot more flexible replacement for the ''hashlimit'' and ''connlimit'' matches in iptables.		Among other things, the combination of dynamic set/map and stateful expressions provide a lot more flexible replacement for the ''hashlimit'' and ''connlimit'' matches in iptables.

	== Using meters ==		== Using meters ==

Pablo: rewrite summary

2023-08-15T21:31:59Z

rewrite summary

← Older revision		Revision as of 21:31, 15 August 2023
Line 1:		Line 1:
	== Meters ==		== Meters ==

	'''Dynamic sets/maps''' ~~or meters are a way~~ to ~~use maps with stateful objects. They used~~ to ~~be known as ''flow tables'' before nft v0.8.1~~ and ~~Linux kernel 4.3~~.		'''Dynamic sets/maps''' allow to add elements to the set/map from the packet path and to attach ratelimit per byte/packet/connection, counter and quota to such elements.

	Among other things, they provide a ~~native~~ replacement for the ''hashlimit'' ~~match in iptables. However, meters are a lot more flexible since you can use any selector, one or many through [[concatenations]].~~		Among other things, they provide a lot more flexible replacement for the ''hashlimit'' and ''connlimit'' matches in iptables.

	'''~~Note that the~~ '~~'meter'' keyword is obsolete, the dynamic set and map syntax is now preferred for consistency~~.~~'''~~

	== Using meters ==		== Using meters ==

Pablo: /* Doing connlimit with nft */ revisit example

2023-08-15T21:26:45Z

Doing connlimit with nft: revisit example

← Older revision		Revision as of 21:26, 15 August 2023
Line 49:		Line 49:
	== Doing connlimit with nft ==		== Doing connlimit with nft ==

	Since 4.18, ~~there is a new~~ ''ct count'' ~~selector that~~ allows you to count the number of existing connections~~. This extension uses the information available in the Connection Tracking System~~ table, ~~therefore,~~ the ~~counting~~ of ~~connection is based on the existing entries in the table~~.		Since 4.18, ''ct count'' allows you to count the number of existing connections based on connection tracking table, you can use it to limit the maximum number of established connections.

	~~The following example shows how to do ''connlimit'' from nftables:~~		<source lang="bash">
			table ip filter {
	table ip ~~my_filter_table~~ {
	set my_connlimit {		set my_connlimit {
	type ipv4_addr		type ipv4_addr
Line 60:		Line 59:
	}		}

	chain ~~my_output_chain~~ {		chain output {
	type filter hook output priority filter; policy accept;		type filter hook output priority filter; policy accept;
	ct state new add @my_connlimit { ip ~~daddr~~ ct count over 20 } counter ~~packets 0 bytes 0~~ drop		ct state new add @my_connlimit { ip saddr ct count over 20 } counter drop
	}		}
	}		}
			</source>

	~~The example above dynamically populates the set ''connlimit'' from the packet path.~~ For ~~the first~~ packet ~~of each connection (ie. packets~~ matching ~~''ct state new'')~~, ~~this~~ adds an ~~entry into~~ ''~~connlimit'' set, this entry uses the IPv4 destination address as~~ a ~~key. If the~~ number of connections ~~goes over 20, then packets are dropped.~~		For each packet matching this rule, it adds an element to the set whose key is 'ip saddr' and it allows a maximum number of 20 established connections to such IP source address.

	~~Since ''connlimit'' is a set, you can perform any operation on it,~~ such ~~as listing and flushing its content.~~

	~~'''Caveats''':~~
	* Do not define a set with a timeout. There is a garbage collector that removes the set element whenever ''ct count'' becomes zero to improve memory usage.
	* For the same reason, you cannot use the ''update'' set statement which allows to refresh the timeout of your set element. Therefore, the ''ct count'' statement can only be used with the ''add'' set statement.

	~~If you define a set with~~ a timeout or you use the ''update'' set statement, ~~then~~ you will hit ~~the~~ "Operation is not supported" error.		'''NOTE:''' This policy does not specifies a timeout to sets intentionally. The connection tracking table timers apply in this case. For the same reason, you cannot use the ''update'' set statement which allows to refresh the timeout of your set element. Therefore, the ''ct count'' statement can only be used with the ''add'' set statement. If you define a timeout to your set and use it with ''ct count'', you will hit an "Operation is not supported" error.

	== Doing iptables hashlimit with nft ==		== Doing iptables hashlimit with nft ==

Pablo: /* Listing meters */ remove listing

2023-08-15T21:11:03Z

Listing meters: remove listing

@@ Line 44: / Line 44: @@
               ct state new update @my_ssh_ratelimit { ip saddr . tcp dport limit rate 3/minute } accept
+       }
+}
 </source>

Pablo: /* Using meters */ use nested notation and refine example

2023-08-15T21:09:02Z

Using meters: use nested notation and refine example

← Older revision		Revision as of 21:09, 15 August 2023
Line 9:		Line 9:
	== Using meters ==		== Using meters ==

	The following ~~commands create a table named ''my_filter_table'', a chain named ''my_input_chain'' which hooks incoming traffic and a rule that uses a meter~~:		The following example shows to how ratelimit inbound TCP connections to port 22 per source IP address:

	<source lang="bash">		<source lang="bash">
	~~% nft add~~ table ~~my_filter_table~~		table ip filter {
	~~% nft add~~ chain ~~my_filter_table my_input_chain~~ {type filter hook input priority 0\;}		set my_ssh_ratelimit {
	~~% nft add set my_filter_table my_ssh_meter { type ipv4_addr\; flags dynamic \;}~~		type ipv4_addr
	~~% nft add rule my_filter_table my_input_chain~~ tcp dport 22 ~~ct state new add~~ @~~my_ssh_meter~~ { ip saddr limit rate 10/~~second~~ } accept		timeout 60s
			flags dynamic
			}

			chain input {
			type filter hook input priority 0; policy drop;

			ct state new tcp dport 22 update @my_ssh_ratelimit { ip saddr limit rate 3/minute } accept
			}
			}
	</source>		</source>

	In this ~~example we create a~~ rule to ~~match~~ ''~~new'' TCP ''ssh'' (port 22) connections, which uses~~ a ~~dynamic set named ''my_ssh_meter''~~ to ~~limit~~ the ~~traffic rate~~ to ~~10 connections per second for each source IP address~~. ~~The available time units on limits are: ''second''~~, ~~''minute'', ''hour'', ''day''~~ and ~~''week''~~.		For each packet matching this rule, it adds an element to the set whose key is 'ip saddr' and it attaches a ratelimiter to such element. If the element already exists, the ratelimiter is applied and the timeout is refreshed to 60 seconds. After 60 seconds of no use, the element expires and the ratelimiter is released.

	You can also use [[concatenations]] to ~~build selectors~~:		You can also use [[concatenations]] to ratelimit the inbound connections per IP source address and TCP destination port:

	<source lang="bash">		<source lang="bash">
	~~% nft add~~ set ~~my_filter_table my_ssh_meter~~ { type ipv4_addr . inet_service\; flags ~~timeout,~~ dynamic \;}		table ip filter {
	~~% nft add rule my_filter_table my_input_chain tcp dport 22~~ ct state new ~~add~~ @~~my_ssh_meter~~ { ip saddr . tcp dport ~~timeout 60s~~ limit rate 10/~~second~~ } accept		set my_ssh_ratelimit {
			type ipv4_addr . inet_service
			timeout 60s
			flags dynamic
			}

			chain input {
			type filter hook input priority 0; policy drop;

			ct state new update @my_ssh_ratelimit { ip saddr . tcp dport limit rate 3/minute } accept
			}
			}
	</source>		</source>

	~~This rule counts incoming connections (packets with state ''new'') based on the tuple ''(IP source address, TCP destination port)'', the counters are dropped after 60 seconds without update.~~

	== Listing meters ==		== Listing meters ==

Pablo: /* Doing connlimit with nft */ document caveats

2021-07-05T20:36:32Z

Doing connlimit with nft: document caveats

← Older revision		Revision as of 20:36, 5 July 2021
Line 67:		Line 67:

	Since ''connlimit'' is a set, you can perform any operation on it, such as listing and flushing its content.		Since ''connlimit'' is a set, you can perform any operation on it, such as listing and flushing its content.

			'''Caveats''':
			* Do not define a set with a timeout. There is a garbage collector that removes the set element whenever ''ct count'' becomes zero to improve memory usage.
			* For the same reason, you cannot use the ''update'' set statement which allows to refresh the timeout of your set element. Therefore, the ''ct count'' statement can only be used with the ''add'' set statement.

			If you define a set with a timeout or you use the ''update'' set statement, then you will hit the "Operation is not supported" error.

	== Doing iptables hashlimit with nft ==		== Doing iptables hashlimit with nft ==

Admin: /* Listing meters */ fix listing of set

2020-09-28T16:39:19Z

Listing meters: fix listing of set

← Older revision		Revision as of 16:39, 28 September 2020
Line 34:		Line 34:

	<source lang="bash">		<source lang="bash">
	% nft list ~~map~~ my_filter_table my_ssh_meter		% nft list set my_filter_table my_ssh_meter
	table ip my_filter_table {		table ip my_filter_table {
	~~map~~ my_ssh_meter {		set my_ssh_meter {
	type ipv4_addr ~~. inet_service~~		type ipv4_addr
	size 65535		size 65535
	flags dynamic~~,timeout~~		flags dynamic
	elements = { 64.62.~~190.36~~ . ~~55000 expires 38s : counter packets~~ 2 ~~bytes 220, 83.98.201.47 . 35460 expires 39s : counter packets~~ 10 ~~bytes 5988, 172.217.7.142 . 43254 expires 46s : counter packets 1 bytes 98~~}		elements = { 10.141.10.2 limit rate 10/second }
	}		}
	}		}
	</source>		</source>

Arturo: /* Meters */ refresh paragraph

2019-10-30T10:56:50Z

Meters: refresh paragraph

← Older revision		Revision as of 10:56, 30 October 2019
Line 1:		Line 1:
	== Meters ==		== Meters ==

	~~Meters~~ used to be known as ''flow tables'' before nft v0.8.1 and Linux kernel 4.3~~, and are a way to use maps with stateful objects~~.		'''Dynamic sets/maps''' or meters are a way to use maps with stateful objects. They used to be known as ''flow tables'' before nft v0.8.1 and Linux kernel 4.3.

	Among other things, they provide a native replacement for the ''hashlimit'' match in iptables. However, meters are a lot more flexible since you can use any selector, one or many through [[concatenations]].		Among other things, they provide a native replacement for the ''hashlimit'' match in iptables. However, meters are a lot more flexible since you can use any selector, one or many through [[concatenations]].

Nevola: /* Doing connlimit with nft */ fix small typo

2019-08-06T14:09:05Z

Doing connlimit with nft: fix small typo

← Older revision		Revision as of 14:09, 6 August 2019
Line 64:		Line 64:
	}		}

	The example above dynamically populates the set ''connlimit'' from the packet path. For the first packet of each connection (ie. packets matching ''ct state new''), this adds an entry into ''connlimit'' set, this entry uses the IPv4 destination address as a key. If the number of ~~connection~~ goes over 20, then packets are dropped.		The example above dynamically populates the set ''connlimit'' from the packet path. For the first packet of each connection (ie. packets matching ''ct state new''), this adds an entry into ''connlimit'' set, this entry uses the IPv4 destination address as a key. If the number of connections goes over 20, then packets are dropped.

	Since ''connlimit'' is a set, you can perform any operation on it, such as listing and flushing its content.		Since ''connlimit'' is a set, you can perform any operation on it, such as listing and flushing its content.