Nftables IP bei zuvielen Anfragen sperren

• Original: https://wiki.archlinux.org/title/Nftables#Dynamic_blackhole
• vim /etc/nftables.conf

table inet filter {
    set blackhole {
        type ipv4_addr;
        flags dynamic, timeout;
        size 65536;
    }

    chain input {
        ...
        ct state new tcp dport 80 \
                meter flood size 128000 { ip saddr timeout 10s limit rate over 10/minute } \
                add @blackhole { ip saddr timeout 1m }

        ip saddr @blackhole counter drop
    }
    ...
}