vidhar: nftables...

1 files changed, 16 insertions, 4 deletions

diff --git a/hosts/vidhar/ruleset.nft b/hosts/vidhar/ruleset.nft
index f02031b4..a996d914 100644
--- a/hosts/vidhar/ruleset.nft
+++ b/hosts/vidhar/ruleset.nft
@@ -1,4 +1,9 @@
 table inet filter {
+  chain reject-rl {
+    limit rate over 1024 / second burst 1024 packets counter drop
+  }
+
+
   chain forward {
     type filter hook forward priority filter
     policy drop
@@ -12,7 +17,10 @@ table inet filter {
     meta l4proto igmp counter accept
 
 
-    log prefix "drop forward: " counter
+    log prefix "reject forward: " counter
+    jump reject-rl
+    meta l4proto tcp counter reject with tcp reset
+    counter reject
   }
 
   chain input {
@@ -21,8 +29,8 @@ table inet filter {
 
 
     iifname lo counter accept
-    iif != lo ip daddr 127.0.0.1/8 counter drop
-    iif != lo ip6 daddr ::1/128 counter drop
+    iif != lo ip daddr 127.0.0.1/8 counter reject
+    iif != lo ip6 daddr ::1/128 counter reject
 
     ct state {established, related} counter accept
 
@@ -36,7 +44,11 @@ table inet filter {
     meta l4proto icmp counter accept
     meta l4proto igmp counter accept
 
-    log prefix "drop input: " counter
+
+    log prefix "reject input: " counter
+    jump reject-rl
+    meta l4proto tcp counter reject with tcp reset
+    counter reject
   }
 
   chain output {