Difference between revisions of "Quotas"

From nftables wiki
Jump to navigation Jump to search
m (intro: even more explicit)
(Added sections on listing and resetting quotas.)
Line 20: Line 20:
     chain IN {
     chain IN {
         type filter hook input priority filter; policy drop;
         type filter hook input priority filter; policy drop;
         udp dport 5060 quota until 100 mbytes accept
         udp dport 5060 quota until 100 mbytes accept
     }
     }
Line 26: Line 27:


= Named quotas =
= Named quotas =
== Declaring and using named quotas ==


You can also declare named quotas, which can be used in multiple rules and maps (only as values, not as keys), as well as reset. For example:
You can also declare named quotas, which can be used in multiple rules and maps (only as values, not as keys), as well as reset. For example:


<source>
<source>
table inet t_quota_demo {
table inet quota_demo {
   quota q_over_sip { over 100 mbytes used 0 bytes }
   quota q_until_sip { until 100 mbytes used 0 bytes }
  quota q_over_http { over  500 mbytes }
 
  chain IN {
      type filter hook input priority filter; policy drop;


  chain c_sip {
       udp dport 5060 quota name "q_until_sip" accept
       type filter hook postrouting priority filter; policy accept;
       tcp dport 80 quota name "q_over_http" drop
       udp dport 5060 quota name "q_over_sip" drop
      tcp dport { 80, 443 } accept
   }
   }


Line 41: Line 48:
</source>
</source>


The above ruleset defines a ''q_over_sip'' quota of ''over 100 mbytes'' with initial count of 0 bytes. The rule in chain ''c_sip'' counts the total bytes of all packets to udp/5060 towards this quota. Packets to udp/5060 are accepted as long as this byte count remains &lt;=&nbsp;100&nbsp;mbytes; once this threshold is exceeded, such packets are dropped.
The above ruleset defines a couple named quotas, each with initial count of 0 bytes. The rules in input chain ''IN'' use these named quotas to:
* accept only up to 100 mbytes total to udp/5060, then drop any additional packets to this (sip) port;
* accept only up to 500 mbytes total to tcp/80, then drop any additional packets to this (http) port;
* accept unlimited packets to tcp/443 (https);
* drop any other packets (note drop policy).
 
 
== Listing named quotas ==
 
''nft list [quota | quotas]'' (as per below) returns the quota(s) with current byte count.
 
* List a particular quota:
<source>
% nft list quota inet quota_demo q_over_http
</source>
 
* List all quotas in a particular table:
<source>
% nft list quotas table inet quota_demo
</source>
 
* List all quotas in ruleset:
<source>
% nft list quotas
</source>
 
 
== Resetting named quotas ==
 
Resetting a quota dumps its current byte count and then resets the byte count to its initial value.
 
* Reset a particular quota:
<source>
% nft reset quota inet quota_demo q_until_sip
</source>
 
* Reset all quotas in a particular table:
<source>
% nft reset quotas table inet quota_demo
</source>
 
* Reset all quotas in ruleset:
<source>
% nft reset quotas
</source>
 
'''Note:''' Resetting quotas does not reset anonymous quotas, see [https://bugzilla.netfilter.org/show_bug.cgi?id=1314 bug #1314].

Revision as of 21:40, 6 April 2021

A quota:

  1. defines a threshold number of bytes;
  2. sets an initial byte count (defaults to 0 bytes if not specified);
  3. counts the total number of bytes, starting from the initial count; and
  4. matches either:
    1. only until the byte count exceeds the threshold, or
    2. only after the byte count is over the threshold.


Anonymous quotas

An anonymous quota is local to the single rule in which it appears. The following example uses an anonymous quota to allow only up to 100 mbytes to port udp/5060:

table inet anon_quota_demo {
    chain IN {
        type filter hook input priority filter; policy drop;

        udp dport 5060 quota until 100 mbytes accept
    }
}

Named quotas

Declaring and using named quotas

You can also declare named quotas, which can be used in multiple rules and maps (only as values, not as keys), as well as reset. For example:

table inet quota_demo {
   quota q_until_sip { until 100 mbytes used 0 bytes }
   quota q_over_http { over  500 mbytes }

   chain IN { 
      type filter hook input priority filter; policy drop;

      udp dport 5060 quota name "q_until_sip" accept
      tcp dport 80 quota name "q_over_http" drop
      tcp dport { 80, 443 } accept
   }

}

The above ruleset defines a couple named quotas, each with initial count of 0 bytes. The rules in input chain IN use these named quotas to:

  • accept only up to 100 mbytes total to udp/5060, then drop any additional packets to this (sip) port;
  • accept only up to 500 mbytes total to tcp/80, then drop any additional packets to this (http) port;
  • accept unlimited packets to tcp/443 (https);
  • drop any other packets (note drop policy).


Listing named quotas

nft list [quota | quotas] (as per below) returns the quota(s) with current byte count.

  • List a particular quota:
% nft list quota inet quota_demo q_over_http
  • List all quotas in a particular table:
% nft list quotas table inet quota_demo
  • List all quotas in ruleset:
% nft list quotas


Resetting named quotas

Resetting a quota dumps its current byte count and then resets the byte count to its initial value.

  • Reset a particular quota:
% nft reset quota inet quota_demo q_until_sip
  • Reset all quotas in a particular table:
% nft reset quotas table inet quota_demo
  • Reset all quotas in ruleset:
% nft reset quotas

Note: Resetting quotas does not reset anonymous quotas, see bug #1314.