Arch Linux

Idlusen

Member

From: France

Registered: 2013-05-15

Posts: 21

nftables: limit connection rate to hostname

Hi, I just researched how to achieve rate limiting at system-level, found nftables (which I didn’t know beforehand, only heard of iptables without using it either), and came up with this configuration:

table ip filter {
	chain output {
		type filter hook output priority filter; policy accept;
		ip daddr 216.58.198.206 ct state new limit rate 20/minute drop
	}
}

The hostname I’m trying to rate-limit to is youtube.com. I tried issuing curl requests in a loop and that seems to work.
I would like to know whether it is possible to dynamically adjust the IP filtered, I could make a loop of "nft replace rule … youtube.com …" but maybe there is a cleaner way.

amish

Member

Registered: 2014-05-10

Posts: 470

Re: nftables: limit connection rate to hostname

Use sets and add/delete IP from the set.

https://wiki.nftables.org/wiki-nftables … Named_sets

Idlusen

Member

From: France

Registered: 2013-05-15

Posts: 21

Re: nftables: limit connection rate to hostname

Thanks I didn’t think of that, but that still requires monitoring to which IP youtube.com is resolved at a given time.

Last edited by Idlusen (2022-08-12 18:49:58)

amish

Member

Registered: 2014-05-10

Posts: 470

Re: nftables: limit connection rate to hostname

Better way to do what you are doing is to use squid proxy. Blocking based on IP is not reliable.

Last edited by amish (2022-08-13 08:34:44)

Idlusen

Member

From: France

Registered: 2013-05-15

Posts: 21

Re: nftables: limit connection rate to hostname

I’ll look into that.