1

I have below nftable rule to add a connection rate meter:

nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip  saddr . tcp dport timeout 5m limit rate 20/minute \} counter accept

It generates the error:

Error: syntax error, unexpected saddr, expecting comma or '}'
add rule ip filter input tcp dport @rate_limit ct state new meter syn4-meter { ip saddr . tcp dport timeout 5m limit rate 20/minute } counter accept
                                                                                  ^^^^^

nftables ruleset

table ip filter {
    chain input {
        type filter hook input priority 0; policy accept;
    }
}
table inet filter {
    set rate_limit {
        type inet_service
        size 50
    }

    chain input {
        type filter hook input priority 0; policy accept;
    }
}

Initially I tried just inet but due to the error I added ip to see if it make any difference to no success. Any pointers?

0

You have two problems:

  • using a too old version of nftables.

    I could reproduce the error Error: syntax error, unexpected saddr, expecting comma or '}' using nftables version 0.7 (as found in Debian 9). Meters (nftables wiki) suggests nftables >= 0.8.1 and kernel >= 4.3.

    Upgrade nftables. Eg, on Debian 9, using the stretch-backports (stretch-backports, not buster-backports) version 0.9.0-1~bpo9+1, sorry you'll have to search how to do that on other distributions.

  • using the wrong table, as told by the command (when using nftables 0.9.2):

    # nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip  saddr . tcp dport timeout 5m limit rate 20/minute \} counter accept
    Error: No such file or directory; did you mean set ‘rate_limit’ in table inet ‘filter’?
    

    Indeed, many objects are local to the table where they are declared. So you can't declare it in the inet filter "namespace" and use it in the ip filter "namespace". That's a difference with for example iptables + ipset, where the same ipset set can be used in any table.

    This will work (once you get a recent enough nftables):

    nft add rule inet filter input tcp dport @rate_limit meter syn4-meter \{ ip  saddr . tcp dport timeout 5m limit rate 20/minute \} counter accept
    

    Or alternatively you can move back the meter definition to the ip filter table.

  • Thanks @A.B I am definitely going to down loads of coffee while upgrading this bad boy -- thanks – losintikfos Sep 17 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.