Re: Question on rate limiting on nftables

On Mon, 8 Jun 2026, at 5:05 PM, Reindl Harald wrote:
> Am 08.06.26 um 17:01 schrieb Andre Rodier:
>> On Mon, 2026-06-08 at 14:32 +0000, Slavko wrote:
>>> D=C5=88a 8. j=C3=BAna 2026 12:45:55 UTC pou=C5=BE=C3=ADvate=C4=BE Ke=
rin Millar
>>> <[email protected]> nap=C3=ADsal:
>>>
>>>> If the problem can be characterised as "I endure too much log noise
>>>> from sshd and I find it annoying" then perhaps configure sshd(8) to
>>>> additionally bind to some other random port than 22 and expose only
>>>> that port.
>>>
>>> Not worth of change ports, soon or latter it will be found
>>> and abused as default port.
>>=20
>> There is a big advantage on changing the port number, though. It is
>> reducing the noise considerably. Also, a connection attempts on a
>> different port should immediately raise attention, as it is involving
>> more than a basic SSH scan bot
>
> and in fact you can have a few ports before as trigger to put the IP o=
n=20
> a drop-list for a few minutes which isn't possible when you host ftp s=
ervers

Indeed. I have implemented a fairly aggressive anti-scanning methodology=
 in nftables on that basis, with only a handful of services exempted (th=
ose that absolutely must remain open to the Internet at large, come what=
 may).

--=20
Kerin Millar