# nft add set inet fw4 blackhole '{ type ipv4_addr; flags dynamic, timeout; }'
# nft add rule inet fw4 raw_prerouting ct state new,invalid,untracked tcp dport 80 meter flood '{ ip saddr timeout 1s limit rate over 10/second }' add @blackhole '{ ip saddr timeout 10m }'
# nft add rule inet fw4 raw_prerouting ip saddr @blackhole counter drop

# nft list ruleset | grep raw_prerouting -A 5
chain raw_prerouting {
        type filter hook prerouting priority raw; policy accept;
        ct state invalid,new,untracked tcp dport 80 meter flood size 65535 { ip saddr timeout 1s limit rate over 10/second } add @blackhole { ip saddr timeout 10m }
        ip saddr @blackhole counter packets 0 bytes 0 drop
    }

# nft list sets
table inet fw4 {
    set blackhole {
        type ipv4_addr
        size 65535
        flags dynamic,timeout
    }
}

I teraz z innego kompa 192.168.22.2 robimy atak na ofiarę na port 80
Ofiara widzi te ataki i odpowiednio je identyfikuje

# nft list ruleset | grep raw_prerouting -A 5
    chain raw_prerouting {
        type filter hook prerouting priority raw; policy accept;
        ct state invalid,new,untracked tcp dport 80 meter flood size 65535 { ip saddr timeout 1s limit rate over 10/second } add @blackhole { ip saddr timeout 10m }
        ip saddr @blackhole counter packets 24952 bytes 12566684 drop
    }

root@OpenWrt:~# nft list sets
table inet fw4 {
    set blackhole {
        type ipv4_addr
        size 65535
        flags dynamic,timeout
        elements = { 192.168.22.2 timeout 10m expires 9m46s270ms }
    }
}