Re: prefix len confusion

On Wed, 10 Jun 2026, at 1:10 AM, Randy Bush wrote:
> [ old dog but new to this list.  apologies for fleas ]
>
> amd64 hardware, not vm
> debian 13, very current
> nftables v1.1.3 (Commodore Bullmoose #4)
>
> tl;dr:
>   o ipv4 ssh dict attacker getting through
>   o i am not an nftables guru; but a few of this have stared at this
>     for many days
>   o do i not understand cidr prefix notation?
>
> essentially, i am seeing the traditional ssh dict attcak to
> 42.642.11.82, when i think i am filtering 42.642.11.80/30, which should
> cover 42.642.11.82

Getting through to where? If you mean to an instance of sshd(8) that's running on the nftables box itself, such is to be expected because you have no chain bearing an "input" hook. The input path is currently wide open.

It could also be that you're expecting your "forward" chain to cover your proxmox guests. But if they are bridged, you may need to perform your filtering at layer 2 instead (or also). That would entail creating a table in the bridge family.

table bridge filter {
    chain wan-in {
        type filter hook forward priority filter;
        ...
    }
}

Incidentally, the iifname "lo" rule serves no purpose in your "forward" chain and can safely be removed.

--
Kerin Millar