+
+ rule << "ct state new" if new_resource.proto == "tcp"
+
+ if new_resource.connection_limit != "-"
+ set = "connlimit-#{new_resource.rule}-#{ip}"
+
+ node.default[:networking][:firewall][:sets] << set
+
+ rule << "add @#{set} { #{ip} saddr ct count #{new_resource.connection_limit} }"
+ end
+
+ if new_resource.rate_limit =~ %r{^s:(\d+)/sec:(\d+)$}
+ set = "ratelimit-#{new_resource.rule}-#{ip}"
+ rate = Regexp.last_match(1)
+ burst = Regexp.last_match(2)
+
+ node.default[:networking][:firewall][:sets] << set
+
+ rule << "update @#{set} { #{ip} saddr limit rate #{rate}/second burst #{burst} packets }"
+ end
+
+ rule << case action
+ when :accept then "accept"
+ when :drop then "jump log-and-drop"
+ when :reject then "jump log-and-reject"
+ end
+
+ if new_resource.source == "fw"
+ node.default[:networking][:firewall][:outgoing] << rule.join(" ")
+ elsif new_resource.dest == "fw"
+ node.default[:networking][:firewall][:incoming] << rule.join(" ")
+ end
+ end
+
+ def nftables_source_ports
+ Array(new_resource.source_ports).map(&:to_s).join(",")
+ end
+
+ def nftables_dest_ports
+ Array(new_resource.dest_ports).map(&:to_s).join(",")