host_firewall: handshake meters per source reject over-limit connections with fw-rl-hs:, SYN meters log fw-rl-addr: and fw-rl-range: as evidence, conntrack accounting on

host_firewall/tasks/main.yml

@@ -38,6 +38,22 @@
     reload: false
   when: firewall.log.all_netns
 
+# The handshake meters match `ct original packets 2`, which counts only with conntrack accounting (off by default).
+# The module is loaded at boot so that systemd-sysctl finds the key.
+- name: Load nf_conntrack at boot
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/nf_conntrack.conf
+    content: "nf_conntrack\n"
+    mode: "0644"
+
+- name: Count packets per connection in conntrack
+  ansible.posix.sysctl:
+    name: net.netfilter.nf_conntrack_acct
+    value: "1"
+    sysctl_file: /etc/sysctl.d/90-nf-conntrack-acct.conf
+    sysctl_set: true
+    reload: false
+
 - name: Install the systemd units
   ansible.builtin.copy:
     src: "{{ item }}"