Quotas - Revision history

Fmyhr: /* Declaring and using named quotas */ Add optional comment attribute.

2021-11-01T17:42:24Z

Declaring and using named quotas: Add optional comment attribute.

← Older revision		Revision as of 17:42, 1 November 2021
Line 35:		Line 35:
	table inet quota_demo {		table inet quota_demo {
	quota q_until_sip { until 100 mbytes used 0 bytes }		quota q_until_sip { until 100 mbytes used 0 bytes }
	quota q_over_http { over 500 mbytes }		quota q_over_http { over 500 mbytes ; comment "cap http (but not https)" ; }

	chain IN {		chain IN {
Line 53:		Line 53:
	* accept unlimited packets to tcp/443 (https);		* accept unlimited packets to tcp/443 (https);
	* drop any other packets (note drop policy).		* drop any other packets (note drop policy).
			The optional ''comment'' attribute requires at least nftables 0.9.7 and kernel 5.10.

	== Listing named quotas ==		== Listing named quotas ==

Fmyhr: Added sections on listing and resetting quotas.

2021-04-06T20:40:44Z

Added sections on listing and resetting quotas.

@@ Line 20: / Line 20: @@
      chain IN {
          type filter hook input priority filter; policy drop;
          udp dport 5060 quota until 100 mbytes accept
+     }
@@ Line 26: / Line 27: @@
 = Named quotas =
 You can also declare named quotas, which can be used in multiple rules and maps (only as values, not as keys), as well as reset. For example:
 <source>
-table inet t_quota_demo {
+table inet quota_demo {
-    quota q_over_sip { over 100 mbytes used 0 bytes }
+    quota q_until_sip { until 100 mbytes used 0 bytes }
-   chain c_sip {
+       udp dport 5060 quota name "q_until_sip" accept
-       type filter hook postrouting priority filter; policy accept;
+       tcp dport 80 quota name "q_over_http" drop
-       udp dport 5060 quota name "q_over_sip" drop
+      tcp dport { 80, 443 } accept
+    }
@@ Line 41: / Line 48: @@
 </source>
-The above ruleset defines a ''q_over_sip'' quota of ''over 100 mbytes'' with initial count of 0 bytes. The rule in chain ''c_sip'' counts the total bytes of all packets to udp/5060 towards this quota. Packets to udp/5060 are accepted as long as this byte count remains &lt;=&nbsp;100&nbsp;mbytes; once this threshold is exceeded, such packets are dropped.
+The above ruleset defines a couple named quotas, each with initial count of 0 bytes. The rules in input chain ''IN'' use these named quotas to:

Fmyhr: intro: even more explicit

2021-04-06T19:36:08Z

intro: even more explicit

← Older revision		Revision as of 19:36, 6 April 2021
Line 3:		Line 3:
	<li>defines a threshold number of bytes;</li>		<li>defines a threshold number of bytes;</li>
	<li>sets an initial byte count (defaults to 0 bytes if not specified);</li>		<li>sets an initial byte count (defaults to 0 bytes if not specified);</li>
	<li>counts the total number of bytes; and</li>		<li>counts the total number of bytes, starting from the initial count; and</li>
	<li>matches either:		<li>matches either:
	<ol style="list-style-type:lower-alpha">		<ol style="list-style-type:lower-alpha">

Fmyhr: Be a bit more explicit in intro. Include anonymous as well as named quotas.

2021-04-06T17:27:17Z

Be a bit more explicit in intro. Include anonymous as well as named quotas.

← Older revision		Revision as of 17:27, 6 April 2021
Line 1:		Line 1:
	A ''quota'':		A ''quota'':
	# defines a threshold number of bytes;		<ol>
	# sets an initial byte count;		<li>defines a threshold number of bytes;</li>
	# counts the total number of bytes; and		<li>sets an initial byte count (defaults to 0 bytes if not specified);</li>
	# matches either ''until'' the byte count exceeds the threshold, or only after the byte count is ''over'' the threshold.		<li>counts the total number of bytes; and</li>
			<li>matches either:
			<ol style="list-style-type:lower-alpha">
			<li>only ''until'' the byte count exceeds the threshold, or</li>
			<li>only after the byte count is ''over'' the threshold.</li>
			</ol>
			</ol>


	For example:		= Anonymous quotas =

			An anonymous quota is local to the single rule in which it appears. The following example uses an anonymous quota to allow only up to 100 mbytes to port udp/5060:

			<source>
			table inet anon_quota_demo {
			chain IN {
			type filter hook input priority filter; policy drop;
			udp dport 5060 quota until 100 mbytes accept
			}
			}
			</source>

			= Named quotas =

			You can also declare named quotas, which can be used in multiple rules and maps (only as values, not as keys), as well as reset. For example:

	<source>		<source>

Fmyhr: Initial quotas page.

2021-04-06T16:27:35Z

Initial quotas page.

New page

A ''quota'':
# defines a threshold number of bytes;
# sets an initial byte count;
# counts the total number of bytes; and
# matches either ''until'' the byte count exceeds the threshold, or only after the byte count is ''over'' the threshold.

For example:

<source>
table inet t_quota_demo {
quota q_over_sip { over 100 mbytes used 0 bytes }

chain c_sip {
type filter hook postrouting priority filter; policy accept;
udp dport 5060 quota name "q_over_sip" drop
}

}
</source>

The above ruleset defines a ''q_over_sip'' quota of ''over 100 mbytes'' with initial count of 0 bytes. The rule in chain ''c_sip'' counts the total bytes of all packets to udp/5060 towards this quota. Packets to udp/5060 are accepted as long as this byte count remains <= 100 mbytes; once this threshold is exceeded, such packets are dropped.