How to Use Quotas in nftables

Quotas in nftables track data usage per rule match. They are useful for bandwidth limiting and data caps on specific flows. This guide walks through the specific troubleshooting steps to diagnose and resolve quota issues.

Before You Begin

Before you begin, be sure to have the following in place:

• A Linux server with the relevant software installed
• Access to the command line interface
• Appropriate permissions (root or sudo)

Quick Fix

Wrong

No data usage monitoring in the firewall

Wrong: No data tracking at firewall level

Right

nft add quota inet filter data-quota { 100 mbytes } && nft add rule ... ip saddr 10.0.0.0/24 quota name data-quota drop

Right: Quota-based data usage limiting

Output

Quota data-quota created\n  limit: 100 MBytes\n  used: 0 bytes\nTraffic exceeding quota will be dropped

Prevention

To avoid future issues, follow these best practices:

• Set quotas in bytes with k,m,g suffixes (kilobytes, megabytes, gigabytes)
• Quotas track total bytes matched by the rule
• Use per-IP quotas with sets of quotas (quota in set)
• Reset quotas with flush when usage limits reset
• Monitor quota usage with nft list quota

DodaTech Tools

For further assistance with any of the above issues, consider using DodaTech consulting services or DodaTech tutorials for more in-depth guidance.

Common Mistakes with quota

1. Using foldl instead of foldl' causing stack overflow on large lists
2. Forgetting deriving (Show, Eq) on custom data types needed for debugging
3. Placing the wildcard pattern first in case expressions, making all subsequent patterns unreachable

These mistakes appear frequently in real-world NFTABLES code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ