From 124c8d627e1313782d38b20ac1d384459beb0dae Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sat, 4 Mar 2023 15:16:45 +0000 Subject: [PATCH] Don't log rate limited echo request packets --- cookbooks/networking/templates/default/nftables.conf.erb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/cookbooks/networking/templates/default/nftables.conf.erb b/cookbooks/networking/templates/default/nftables.conf.erb index 7f0b1e17e..cb9891624 100644 --- a/cookbooks/networking/templates/default/nftables.conf.erb +++ b/cookbooks/networking/templates/default/nftables.conf.erb @@ -61,10 +61,12 @@ table inet filter { ct state { established, related } accept icmp type { destination-unreachable } accept - icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } accept - icmp type { echo-request } limit rate 1/second accept + icmp type { echo-request } drop + + icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert } accept icmpv6 type { echo-request } limit rate 1/second accept + icmpv6 type { echo-request } drop meta l4proto { icmp, icmpv6 } jump log-and-drop -- 2.39.5