burst/limiting only on nat table rule?

"Brian J. Murrell" <[email protected]> Mon, 07 Oct 2024 15:50:40 -0400

Newsgroups	gmane.comp.security.shorewall
Message-ID	<[email protected]>

I have a burst/limit defined for a DNAT rule in a macro.SVCS file:

DNAT	net	$INT_PBX	udp	5060	-	-	s:SIP:3/min

which I then call from my rules file with:

SVCS	net		-

But when I see what shorewall did with that in terms of iptables rules
I see this in the filter table:

    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            10.75.22.8           udp dpt:5060 /* SVCS */

and this in the nat table:

    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:5060 limit: up to 3/min burst 5 mode srcip /* SVCS */ to:10.75.22.8

As you can see the burst/limit only applied to the nat table rule and
not the filter table rule.

Is this expected?

Cheers,
b.

signature.asc (application/pgp-signature, 488 B)