Skip to main content

Firewall rate limits and ICMP rules

Diagram showing WAN traffic classes, FirewallRule rate and connection limits, and generated stateful nftables filtering

This example shows stateful FirewallRule expressions for a small router:

  • allow HTTP and HTTPS on the router with one multi-port rule
  • allow only ICMP echo requests from the WAN
  • reject SSH attempts that exceed a packet rate or per-source connection limit

The complete YAML is in examples/firewall-rate-limit.yaml.

Firewall groundwork

These rules are an example of routerd's current firewall groundwork, not a complete Internet-security policy. Test them on an isolated host and do not use them as the only protection for a reachable router.

Apply sequence​

routerd validate --config examples/firewall-rate-limit.yaml

workdir=$(mktemp -d)
routerd apply --config examples/firewall-rate-limit.yaml --once --dry-run \
  --state-file "$workdir/state.db" \
  --ledger-file "$workdir/ledger.db" \
  --status-file "$workdir/status.json"
rm -rf "$workdir"

Rule excerpt​

- apiVersion: firewall.routerd.net/v1alpha1
  kind: FirewallRule
  metadata:
    name: ssh-bruteforce-over-limit
  spec:
    fromZone: wan
    toZone: self
    protocol: tcp
    destinationPorts:
      - "22"
    action: reject
    rateLimit:
      rate: 8
      burst: 16
      unit: packet
      per: minute
      log: true
    connLimit:
      maxPerSource: 4
      log: true