http://wiki.nftables.org/wiki-nftables/index.php?action=history&feed=atom&title=Talk%3ARate_limiting_matchingsTalk:Rate limiting matchings - Revision history2026-05-12T14:35:30ZRevision history for this page on the wikiMediaWiki 1.43.6http://wiki.nftables.org/wiki-nftables/index.php?title=Talk:Rate_limiting_matchings&diff=508&oldid=prevGlloyd: Adding some questions on ICMP, IGMP, and rate limiting2020-06-16T18:51:41Z<p>Adding some questions on ICMP, IGMP, and rate limiting</p>
<p><b>New page</b></p><div>(1) I'm not an expert so more examples on rate-limited ICMP rules would be very helpful.<br />
<br />
(2) Which ICMP packet types should be allowed? All? Or only certain types?<br />
<br />
(3) Is IGMP ok to allow all packets on?<br />
<br />
I've seen rules like this but I don't know enough to understand what the impact would be. I also don't fully understand what 'meta l4proto' is doing (From ArchWiki: https://wiki.archlinux.org/index.php/Nftables)<br />
<br />
<source lang="bash"><br />
meta l4proto ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept comment "Accept ICMPv6"<br />
<br />
meta l4proto icmp icmp type { destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } accept comment "Accept ICMP"<br />
<br />
ip protocol igmp accept comment "Accept IGMP"<br />
</source></div>Glloyd