host_firewall: per-service new-connection meters per source (/32, /64) and per range (/24, /48) from measured peaks, excess dropped with prefix fw-ratelimit:, replaces the ssh meter

host_firewall/defaults/main.yml

@@ -44,12 +44,36 @@ firewall:
   # in on ifaces pass, the listed ports and types pass, the rest to daddr drops;
   # traffic to other addresses is not filtered.
   forward_guard: {}
-  ssh_rate_limit: "10/minute burst 5 packets"
-  # Kernel log of dropped inbound packets (fw-in-drop: ) and of rejected
+  # Limits on new inbound TCP connections per service, applied to the public and geo ports the host serves (input) and to
+  # DNATed traffic (forward: port forwards and Docker-published ports), after the admin, cluster, VPN, guest and internal
+  # sources are exempted. Each service has a tier per source (IPv4 /32, IPv6 /64) and a tier per range (IPv4 /24, IPv6
+  # /48) at rate * range_factor. The excess drops with the log prefix fw-ratelimit: (log.ratelimit_rate).
+  # name -> {ports: port or list, rate: connections per `per`, per: second|minute (minute), burst: connections (2 * rate),
+  # range_factor_v4, range_factor_v6: override the factors below}; null drops a service, a service is idle unless a port is served.
+  # Values are 3x the highest legitimate rate seen, with a floor of 12 per minute (3x four connections per minute) where
+  # there is no or too little history; the measurement is noted at each service.
+  ratelimit:
+    range_factor:
+      v4: 6
+      v6: 3
+    services:
+      # 14 days of sshd Accepted lines in VictoriaLogs (all hosts, per host and source, /64 and /24 grouped): at most 8 per
+      # minute and 4 per 10 seconds from one address or /64 (Ansible runs), 22 per 10 minutes.
+      ssh:
+        ports: 22
+        rate: 24
+      # 14 days of Traefik access logs of the cluster: distinct client ports of one source within a minute, which bounds the
+      # new connections, at most 51 (IPv4) and 58 (IPv6 /64); 16 per second at most. Applies to the host ports 80 and 443.
+      web:
+        ports: [80, 443]
+        rate: 180
+  # Kernel log of dropped inbound packets (fw-in-drop: ), rate-limited connections (fw-ratelimit: ) and of rejected
   # outbound mail (fw-out-reject: ), read from the journal by CrowdSec. Each
   # rate is one limit shared by all matching packets.
   log:
     in_rate: "5/second burst 30 packets"
+    # Shared by all rate-limited connections (fw-ratelimit: ), one limit.
+    ratelimit_rate: "5/second burst 30 packets"
     out_rate: "6/minute burst 5 packets"
     # Lets the kernel log the nft log statements of container network
     # namespaces (LXC guests) into the host kernel log.