Assistance requested: nftables rate-limiting/logging failure (v1.1.6)

Dae Euhwa <[email protected]> Sat, 28 Mar 2026 01:24:30 +0100
Newsgroups	gmane.comp.security.firewalls.netfilter.general
Message-ID	<[email protected]>
--b-Et2lz7
Content-Type: multipart/alternative; boundary=bRXiF_Dk

--bRXiF_Dk
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hello,

My=C2=A0name=C2=A0is=C2=A0Dae=C2=A0Euhwa.=C2=A0I=C2=A0am=C2=
=A0relatively=C2=A0new=C2=A0to=C2=A0nftables=C2=A0and=C2=A0am=C2=A0having=
=C2=A0trouble=C2=A0replicating=C2=A0a=C2=A0previously=C2=A0functional=C2=
=A0configuration.

I=C2=A0am=C2=A0currently=C2=A0facing=C2=A0a=C2=A0sit=
uation=C2=A0where=C2=A0my=C2=A0rate-limiting=C2=A0logic=C2=A0is=C2=A0not=
=C2=A0triggering=C2=A0as=C2=A0expected;=C2=A0specifically,=C2=A0I=C2=A0am=
=C2=A0seeing=C2=A0no=C2=A0NFT_BAN=C2=A0logs=C2=A0despite=C2=A0high-volume=
=C2=A0traffic=C2=A0(verified=C2=A0via=C2=A0tcpdump).=C2=A0I=C2=A0suspect=
=C2=A0a=C2=A0rule=C2=A0precedence=C2=A0or=C2=A0logical=C2=A0error=C2=A0in=
=C2=A0my=C2=A0chain=C2=A0ordering=C2=A0is=C2=A0causing=C2=A0packets=C2=
=A0to=C2=A0be=C2=A0accepted=C2=A0before=C2=A0they=C2=A0hit=C2=A0the=C2=
=A0meter.

Environment=C2=A0Details:
*=C2=A0Version:=C2=A01.1.6=C2=
=A0(Commodore=C2=A0Bullmoose=C2=A0#7)
*=C2=A0Goal:=C2=A0Implement=C2=
=A0a=C2=A0penalty=C2=A0box=C2=A0via=C2=A0meters=C2=A0and=C2=A0sets=C2=A0for=
=C2=A0high-volume=C2=A0floods.

I=C2=A0have=C2=A0attached=C2=A0my=C2=
=A0current=C2=A0config=C2=A0file=C2=A0for=C2=A0review.=C2=A0Any=C2=A0insigh=
t=C2=A0into=C2=A0why=C2=A0the=C2=A0meter/log=C2=A0actions=C2=A0are=C2=A0bei=
ng=C2=A0bypassed=C2=A0would=C2=A0be=C2=A0greatly=C2=A0appreciated.

Tha=
nk=C2=A0you=C2=A0for=C2=A0your=C2=A0time=C2=A0and=C2=A0assistance.=C2=A0I=
=C2=A0look=C2=A0forward=C2=A0to=C2=A0your=C2=A0response.

Best=C2=A0reg=
ards,
Dae=C2=A0Euhwa


--bRXiF_Dk
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><body><div style=3D"font-family: 'Helvetica Neue', Helvetica, Arial, =
sans-serif; font-size: 14px"><div class=3D"formatted-code-block-internal-co=
ntainer ng-tns-c3776750516-138"><div class=3D"animated-opacity ng-tns-c3776=
750516-138"><pre class=3D"ng-tns-c3776750516-138"><code class=3D"code-conta=
iner formatted ng-tns-c3776750516-138" data-test-id=3D"code-content" role=
=3D"text">Hello,

My name is Dae Euhwa. I am relatively new to nftables and am having trouble=
 replicating a previously functional configuration.

I am currently facing a situation where my rate-limiting logic is not trigg=
ering as expected; specifically, I am seeing no NFT<span class=3D"hljs-emph=
asis">_BAN logs despite high-volume traffic (verified via tcpdump). I suspe=
ct a rule precedence or logical error in my chain ordering is causing packe=
ts to be accepted before they hit the meter.

Environment Details:
* Version: 1.1.6 (Commodore Bullmoose #7)
* Goal: Implement a penalty box via meters and sets for high-volume floods.

I have attached my current config file for review. Any insight into why the=
 meter/log actions are being bypassed would be greatly appreciated.

Thank you for your time and assistance. I look forward to your response.

Best regards,
Dae Euhwa</span></code><br></pre></div></div></div></body></html>
--bRXiF_Dk--

--b-Et2lz7
X-WS-Attachment-UUID: 5b40b78c-086b-4a4e-a8f5-979865f53cbb
Content-Type: application/octet-stream; name=nftables.conf
Content-Transfer-Encoding: base64
Content-Disposition: attachment; name=nftables.conf; filename=nftables.conf

IyEvdXNyL3NiaW4vbmZ0IC1mCmZsdXNoIHJ1bGVzZXQKCmluY2x1ZGUgIi9ldGMvbmZ0YWJsZXMu
ZC9jb3VudHJ5X2Jsb2Nrcy5uZnQiCgp0YWJsZSBpbmV0IGZpbHRlciB7CiAgICBjaGFpbiBpbnB1
dCB7CiAgICAgICAgdHlwZSBmaWx0ZXIgaG9vayBpbnB1dCBwcmlvcml0eSAwOyBwb2xpY3kgZHJv
cDsKCiAgICAgICAgIyBFc3NlbnRpYWw6IExvb3BiYWNrCiAgICAgICAgaWlmIGxvIGFjY2VwdAog
ICAgICAgIAogICAgICAgICMgRXNzZW50aWFsOiBFc3RhYmxpc2hlZC9yZWxhdGVkIChieXBhc3Mg
cmF0ZSBsaW1pdHMgZm9yIGFjdGl2ZSBjb25uZWN0aW9ucykKICAgICAgICBjdCBzdGF0ZSBlc3Rh
Ymxpc2hlZCxyZWxhdGVkIGFjY2VwdAogICAgICAgIAogICAgICAgICMgRXNzZW50aWFsOiBJQ01Q
CiAgICAgICAgaXAgcHJvdG9jb2wgaWNtcCBhY2NlcHQKICAgICAgICBpcDYgbmV4dGhkciBpY21w
djYgYWNjZXB0CiAgICAgICAgCiAgICAgICAgIyBUcnVzdGVkIExBTiAoYnlwYXNzIHJhdGUgbGlt
aXRzIGZvciB5b3VyIG5ldHdvcmspCiAgICAgICAgaXAgc2FkZHIgMTkyLjE2OC4xLjAvMjQgYWNj
ZXB0CiAgICAgICAgCiAgICAgICAgIyBESENQIHJlc3BvbnNlcwogICAgICAgIHVkcCBzcG9ydCA2
NyB1ZHAgZHBvcnQgNjggYWNjZXB0CiAgICAgICAgCiAgICAgICAgIyA9PT0gUmF0ZSBsaW1pdGlu
ZyBNVVNUIGNvbWUgYmVmb3JlIHNlcnZpY2UgYWNjZXB0cyA9PT0KICAgICAgICAjIEdsb2JhbDog
MTAwMC9taW4gcGVyIElQIChsb2cgdGhlbiBkcm9wKQogICAgICAgIG1ldGVyIGdsb2JhbF9saW1p
dCB7IGlwIHNhZGRyIGxpbWl0IHJhdGUgb3ZlciAxMDAwL21pbnV0ZSBidXJzdCAyMDAgcGFja2V0
cyB9IGxvZyBwcmVmaXggIk5GVF9CQU46ICIgZHJvcAogICAgICAgIAogICAgICAgICMgQ291bnRy
eSBibG9ja3MgKHNpbGVudCBkcm9wIGFmdGVyIHJhdGUgbGltaXQgY2hlY2spCiAgICAgICAgaXAg
c2FkZHIgQGNvdW50cnlfYmxvY2tzIGRyb3AKICAgICAgICAKICAgICAgICAjIFNlcnZpY2VzIChv
bmx5IHJlYWNoYWJsZSBpZiBub3QgcmF0ZSBsaW1pdGVkKQogICAgICAgIHRjcCBkcG9ydCB7IDIy
LCA1MywgODAsIDQ0MywgNzc0MiwgODUzIH0gYWNjZXB0CiAgICAgICAgdWRwIGRwb3J0IHsgNTMs
IDEyMywgODUzLCAxOTEzMiB9IGFjY2VwdAogICAgfQogICAgCiAgICBjaGFpbiBmb3J3YXJkIHsg
dHlwZSBmaWx0ZXIgaG9vayBmb3J3YXJkIHByaW9yaXR5IDA7IHBvbGljeSBkcm9wOyB9CiAgICBj
aGFpbiBvdXRwdXQgeyB0eXBlIGZpbHRlciBob29rIG91dHB1dCBwcmlvcml0eSAwOyBwb2xpY3kg
YWNjZXB0OyB9Cn0K
--b-Et2lz7--