NFTables Honeypot Example

nftables.conf

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    set honeypot_ipv4 {
      type ipv4_addr
      flags dynamic,timeout
      timeout 1d
}


    chain input {
        type filter hook input priority 0;
        iifname "lo" return
        ip saddr @honeypot_ipv4 counter drop
        tcp dport 22 add @honeypot_ipv4 { ip saddr timeout 1d }
    }
    chain forward {
        type filter hook forward priority 0;
    }
    chain output {
        type filter hook output priority 0;
    }
}