# Meters, byte rates and quotas, as hand-written rulesets use them (importer_test.go).
table inet main {
	set ssh_meter {
		type ipv4_addr
		flags dynamic,timeout
		timeout 1m
	}
	set ssh6_meter {
		type ipv6_addr
		flags dynamic,timeout
		timeout 1m
	}
	set my_connlimit {
		type ipv4_addr
		size 65535
		flags dynamic
	}
	set guest_quota {
		type ipv4_addr
		size 65535
		flags dynamic
	}
	set trusted {
		type ipv4_addr
		flags interval
		elements = { 10.0.10.0/24 }
	}
	chain input {
		type filter hook input priority filter; policy drop;
		ct state established,related accept
		tcp dport 22 ct state new update @ssh_meter { ip saddr limit rate over 3/minute burst 5 packets } counter drop
		tcp dport 22 ct state new update @ssh6_meter { ip6 saddr and ffff:ffff:ffff:ffff:: limit rate over 3/minute } counter drop
		ip saddr @trusted tcp dport 22 accept
	}
	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state new add @my_connlimit { ip saddr ct count over 20 } counter drop
		iifname "lan" oifname "wan" limit rate over 10 mbytes/second burst 512 kbytes drop
		iifname "guest0" oifname "wan" add @guest_quota { ip saddr and 255.255.255.0 quota over 1000 mbytes } drop
		iifname "lan" oifname "wan" quota over 100000 mbytes drop
		iifname "lan" oifname "wan" accept
	}
	chain output {
		type filter hook output priority filter; policy accept;
	}
}