Following this article on nftables Blocking IP addresses that attempt more than ten new incoming TCP connections within one minute how would one add a whitelist like ip saddr != { ip1, ip2,... }?

table ip filter {
        set denylist {
                type ipv4_addr
                flags dynamic,timeout
                timeout 1m

        chain input {
                type filter hook input priority filter; policy accept;
                ip protocol tcp ct state new,untracked update @denylist { ip saddr limit rate over 10/minute } drop

1 Answer 1


This works for me

# rate limits
ip saddr != { $IP1, $IP2 } ip protocol tcp ct state new,untracked limit rate over 2/second update @denylist { ip saddr }
ip saddr @denylist drop

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .