From: jadhav vishwanath <jvishwanath66@gmail.com>
To: netfilter@vger.kernel.org
Subject: About adding a nft rule to limit opensearch connections
Date: Wed, 17 Jan 2024 13:19:19 +0530 [thread overview]
Message-ID: <CABP7cfEEnu_Fo+A04rA24=cbXogizArRigsgd+KbVyEPj9nFPw@mail.gmail.com> (raw)
Hi I am trying to apply the nft rule to limit the connections on
opernsearch port 9200.
I successfully limit the number of connections for SSH port. used
following rule to limit the same
Following rules are applied on server side machines(opensearch and sshd)
~] cat rule.nft
{
flush ruleset
table ip filter {
set test-22-count-meter {
type ipv4_addr
size 65535
flags dynamic
}
chain INPUT {
type filter hook input priority filter - 5; policy drop;
ct state new tcp dport 22 update @test-22-count-meter
{ ip saddr & 255.255.255.0 ct count over 5 } counter packets 0 bytes
0 reject
iifname "eth0" tcp dport 22 counter packets 0 bytes 0 accept
}
----
----
}
}
Same thing, I am trying to limit the connections for port 9200, but it
seems the rule is not behaving properly, it is blocking connection
(zero connection accepted).
~] cat rule.nft
{
flush ruleset
table ip filter {
set test-9200-count-meter {
type ipv4_addr
size 65535
flags dynamic
}
chain INPUT {
type filter hook input priority filter - 5; policy drop;
ct state new tcp dport 9200 update
@test-9200-count-meter { ip saddr & 255.255.255.0 ct count over 5 }
counter packets 0 bytes 0 reject
iifname "eth0" tcp dport 9200 counter packets 0 bytes 0 accept
}
----
----
}
}
Am I missing any kernel modules which should be enabled, or following
some wrong format?
Also, when ESTABLISH it holds the connections though clients are disconnected.
--
--Regards
Vishwanath
reply other threads:[~2024-01-17 7:49 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CABP7cfEEnu_Fo+A04rA24=cbXogizArRigsgd+KbVyEPj9nFPw@mail.gmail.com' \
--to=jvishwanath66@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).