使用nftables创建动态黑名单

我想用nftables创建一个动态黑名单。在嵌入式设备上的0.8.3版本下，我使用nft list规则集创建一个规则集，如下所示：

table inet filter {
set blackhole {
    type ipv4_addr
    size 65536
    flags timeout
}

chain input {
    type filter hook input priority 0; policy drop;
    ct state invalid drop
    ct state established,related accept
    iif "lo" accept
    ip6 nexthdr 58 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, mld-listener-query, mld-listener-report, mld-listener-done, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept
    ip protocol icmp icmp type { echo-reply, destination-unreachable, echo-request, router-advertisement, router-solicitation, time-exceeded, parameter-problem } accept
    ip saddr @blackhole counter packets 0 bytes 0 drop
    tcp flags syn tcp dport ssh meter flood { ip saddr timeout 1m limit rate over 10/second burst 5 packets}  set add ip saddr timeout 1m @blackhole drop
    tcp dport ssh accept
}

chain forward {
    type filter hook forward priority 0; policy drop;
}

chain output {
    type filter hook output priority 0; policy accept;
}
}

对我来说，这只是一个临时解决方案。我想将官方手册页中的示例用于动态黑名单。如果我使用手册页中的官方示例，我的nftables文件将如下所示：

table inet filter {
set blackhole{
        type ipv4_addr
        flags timeout
        size 65536
}
chain input {
        type filter hook input priority 0; policy drop;

        # drop invalid connections
        ct state invalid drop

        # accept traffic originating from us
        ct state established,related accept

        # accept any localhost traffic
        iif lo accept

        # accept ICMP
        ip6 nexthdr 58 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, mld-listener-query, mld-listener-report, mld-listener-done, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept
        ip protocol icmp icmp type { destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem, echo-request, echo-reply } accept

        # accept SSH (port 22)
        ip saddr @blackhole counter drop
        tcp flags syn tcp dport ssh meter flood { ip saddr timeout 10s limit rate over 10/second} add @blackhole { ip saddr timeout 1m } drop
        tcp dport 22 accept

}


chain forward {
        type filter hook forward priority 0; policy drop;
}

chain output {
        type filter hook output priority 0; policy accept;
}

}

但是，当我使用nft -f myfile在版本0.8.3上加载此nftables文件时，出现此错误：

Error: syntax error, unexpected add, expecting newline or semicolon
    tcp flags syn tcp dport ssh meter flood { ip saddr timeout 10s limit rate over 10/second} add @blackhole { ip saddr timeout 1m } drop

我不知道为什么会这样，但是根据Wiki，它应该在版本0.8.1和内核4.3中工作。

我有版本0.8.3和内核4.19.94。

我已经在Debian Buster的0.9.0版官方手册中测试了该规则集。联机帮助页上的规则集可与Debian配合使用，但ip仅被阻止一次。

在此示例中，我想创建一个防火墙规则，如果对我的设备启动了暴力攻击，它将阻止ssh端口上的ip地址。但我想阻止IP例如5分钟。在那之后，应该可以从攻击者ip重新连接到设备。如果他再次进行暴力破解，则应再次阻止ip 5分钟，依此类推。如果要使用nftables，我想避免对我的嵌入式设备使用sshguard或fail2ban之类的其他软件。

我希望任何人都能帮助我。谢谢！