From: Tom Hughes <tom@compton.nu>
Date: Sat, 4 Mar 2023 15:16:45 +0000 (+0000)
Subject: Don't log rate limited echo request packets
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/124c8d627e1313782d38b20ac1d384459beb0dae

Don't log rate limited echo request packets
---

diff --git a/cookbooks/networking/templates/default/nftables.conf.erb b/cookbooks/networking/templates/default/nftables.conf.erb
index 7f0b1e17e..cb9891624 100644
--- a/cookbooks/networking/templates/default/nftables.conf.erb
+++ b/cookbooks/networking/templates/default/nftables.conf.erb
@@ -61,10 +61,12 @@ table inet filter {
     ct state { established, related } accept
 
     icmp type { destination-unreachable } accept
-    icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } accept
-
     icmp type { echo-request } limit rate 1/second accept
+    icmp type { echo-request } drop
+
+    icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } accept
     icmpv6 type { echo-request } limit rate 1/second accept
+    icmpv6 type { echo-request } drop
 
     meta l4proto { icmp, icmpv6 } jump log-and-drop