Per-key rate limiting using dynamic sets (meters).

Meters provide stateful rate limiting on a per-key basis (e.g., per-IP address). They use dynamic sets to track keys and enforce rate limits independently for each key.

This replaces iptables' hashlimit functionality with a more flexible approach.

Import

import NFTables.Expr.Meter

Overview

A meter consists of:

• A dynamic set to store keys
• A key expression (what to track: IP, port, tuple, etc.)
• A limit statement (rate limit per key)
• Optional timeout (how long to keep inactive keys)

Workflow

1. Create a dynamic set with NFTables.add(set: ...)
2. Use meter expressions in rules to track and limit per-key
3. nftables automatically manages set entries with timeouts

Examples

import NFTables.Match
import NFTables.Match.Meter
alias NFTables.Builder

# Step 1: Create dynamic set
Builder.new(family: :inet)
|> NFTables.add(table: "filter")
|> NFTables.add(
  set: "ssh_ratelimit",
  table: "filter",
  type: :ipv4_addr,
  flags: [:dynamic],
  timeout: 60,    # Expire after 60s inactivity
  size: 10000     # Max 10k tracked IPs
)
|> NFTables.submit(pid: pid)

# Step 2: Use meter in rule
ssh_rule = rule()
  |> tcp()
  |> dport(22)
  |> ct_state([:new])
  |> meter_update(
    payload(:ip, :saddr),  # Track by source IP
    "ssh_ratelimit",        # Set name
    3,                      # 3 connections
    :minute,                # per minute
    burst: 5                # Allow burst of 5
  )
  |> accept()


Builder.new()
|> NFTables.add(rule: ssh_rule, table: "filter", chain: "input", family: :inet)
|> NFTables.submit(pid: pid)

Set Types for Keys

• :ipv4_addr - Track by IPv4 address
• :ipv6_addr - Track by IPv6 address
• :inet_proto - Track by protocol number
• :inet_service - Track by port number
• Composite types: {:concat, [:ipv4_addr, :inet_service]} - Track by IP+port tuple

Use Cases

• SSH brute-force protection: Limit connections per IP
• HTTP flood protection: Limit requests per source
• Port scan detection: Limit new connections per IP
• Fair bandwidth sharing: Limit throughput per user/IP
• SYN flood protection: Limit SYN packets per source

For more information, see the nftables meters wiki.