I am using nftables v0.9.6 and the geoip database to drop inbound traffic from specific countries.
For example, I have in a chain:

meta mark 0x0000033a drop comment "block traffic from GB"

Better, I would like to count, log and drop the traffic.
I think I should add these instructions:

meta mark 0x0000033a counter name "drop_gb" log prefix "drop_gb:" drop comment "block traffic from GB"

Honestly I did not try it but I am confident it would work 🙂
Unfortunately I got stuck on the next step: I wanted to add a limit to the logging action to avoid disk, especially on small embedded platforms, getting filled up by logfiles in case of an prolonged attack.

I usually add a limit rate 120/minute burst 300 packets instruction before the log command as in:

meta mark 0x0000033a counter name "drop_gb" limit rate 120/minute burst 300 packets log prefix "drop_gb:" drop comment "block traffic from GB"

but I think here I would get the (unwanted) side effect that also the drop action will be “limited”!

I mean that with the above rule only the logged traffic will be dropped, getting the weird result that traffic over the threshold (a strong attack) won’t be dropped. Am I right?

I’d like to keep the “oneliner” approach to have more readable rules (they are several and script-generated): is there any way to achieve “limited” log with “full” packet drop?

Thank you!

S.