2.10. Using nftables to limit the amount of connections

Procedure

1. Create the filter table with the inet address family:

   # nft add table inet filter

2. Add the input chain to the inet filter table:

   # nft add chain inet filter input { type filter hook input priority 0 \; }

3. Create a dynamic set for IPv4 addresses:

   # nft add set inet filter limit-ssh { type ipv4_addr\; flags dynamic \;}

4. Add a rule to the input chain that allows only two simultaneous incoming connections to the SSH port (22) from an IPv4 address and rejects all further connections from the same IP:

   # nft add rule inet filter input tcp dport ssh ct state new add @limit-ssh { ip saddr ct count over 2 } counter reject

Verification

1. Establish more than two new simultaneous SSH connections from the same IP address to the host. Nftables refuses connections to the SSH port if two connections are already established.

2. Display the limit-ssh dynamic set:

   # nft list set inet filter limit-ssh
   table inet filter {
     set limit-ssh {
       type ipv4_addr
       size 65535
       flags dynamic
       elements = { 192.0.2.1 ct count over 2 , 192.0.2.2 ct count over 2 }
     }
   }

   The elements entry displays addresses that currently match the rule. In this example, elements lists IP addresses that have active connections to the SSH port. Note that the output does not display the number of active connections or if connections were rejected.

Procedure

1. Create the filter table with the ip address family:

   # nft add table ip filter

2. Add the input chain to the filter table:

   # nft add chain ip filter input { type filter hook input priority 0 \; }

3. Add a set named denylist to the filter table:

   # nft add set ip filter denylist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }

   This command creates a dynamic set for IPv4 addresses. The timeout 5m parameter defines that nftables automatically removes entries after five minutes to prevent that the set fills up with stale entries.

4. Add a rule that automatically adds the source IP address of hosts that attempt to establish more than ten new TCP connections within one minute to the denylist set:

   # nft add rule ip filter input ip protocol tcp ct state new, untracked add @denylist { ip saddr limit rate over 10/minute } drop