From 4479dd486df60c49ea80ef900112b6e8c78c4d44 Mon Sep 17 00:00:00 2001 From: hygienic-books Date: Sat, 16 Jul 2022 02:10:23 +0200 Subject: [PATCH] docs(config): Explain hitcount setting --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 9640f46..bc7a7e7 100644 --- a/README.md +++ b/README.md @@ -274,6 +274,10 @@ A custom `[section]` has the following options. We're calling them locals most o state = ``` +* `hitcount`, **_optional_**, defaults to an empty value: A rate-limiting feature. Set this to `hits/seconds` to limit the amount of matched packets to `hits` over the course of `seconds`, e.g. `10/60` sets the maximum packet rate to 10 packets over the course of 60 seconds. Any packet exceeding the rate will be dropped. + + Adding a `hitcount` will automatically add 2 `ip(6)tables` rules right before the actual rules. Rules follow the [iptables "recent" extension](https://ipset.netfilter.org/iptables-extensions.man.html#lbBW). The first rule does `--update`, the second one does `--set` followed by the rule you specified. + * `do_ipv6`, __*optional*__, defaults to `false`: Decide if you want `firewalld` to generate `ip6tables` rules in addition to `iptables` rules. A default install of Docker Engine will have its IPv6 support disabled in `/etc/docker/daemon.json`. You may still want your machine to handle incoming IPv6 traffic. If your machine truly doesn't use IPv6 feel free to leave this at `false`. Otherwise `update-firewall-source.py` generates unused rules that clutter your rule set. If this is `true` IPv6 addresses found or resolved in `addr` in a `[section]` will be discarded.