Re: Question on rate limiting on nftables

On 6/8/26 18:01, Andre Rodier wrote:
> Also, a connection attempts on a
> different port should immediately raise attention, as it is involving
> more than a basic SSH scan bot.

Shifting ports might quiet the logs somewhat, but your SSH port will be=20
found both quickly and easily by bots.  That has been the case for a=20
long time:

  https://bsdly.blogspot.com/2013/02/theres-no-protection-in-high-ports.ht=
ml

It is difficult to fit nftables into mitigations for those probes=20
because modern scans usually come from a wide spread of addresses and=20
networks.  In the case of SSH, using SSH keys (or even SSH certificates)=
=20
and turning off password authentication clears out a lot of the bots,=20
but that has been mentioned already.

/Lars