Your first rules a file that drops what a web server never needs.

A moat file is a list of declarations: the language version, the default verdict, constants, sets and rules. Rules are checked against every packet in order; the first rule that decides the packet's fate wins.

version 1
default pass

use std.bogons

set banned addresses ttl 10m

rule known_bad { when ip.src in banned then drop }

# one /24 opening connections too fast
rule syn_flood {
    when tcp.dport in {80, 443} and tcp.flags == {syn}
    then limit 100/s per ip.src/24 burst 200
        on exceed add ip.src to banned, drop
}

Reading it

• default pass lets through every packet no rule decides.
• use std.bogons drops sources that are never valid on the wire.
• banned is a set of addresses that forget each entry after ten minutes.
• syn_flood lets each /24 open 100 connections a second, with room for 200 at once. Above that, the source goes into banned and the packet is dropped, and from then on known_bad drops everything it sends.

Check and format

$ moat check web.moat
$ moat fmt -w web.moat

moat check prints errors and warnings with the line and column, and a hint when a field name is misspelled. It also warns about rules that can never match because an earlier rule already decides every packet they would see. It exits with 1 when there are errors; with --deny-warnings warnings fail too, which is useful in CI. moat fmt -w rewrites the file in its canonical form; in CI, moat fmt --check *.moat fails when a file is not formatted.

Before loading anything, test the rules.

Already filtering with iptables or nftables? Import your rules from iptables or nftables instead of starting from an empty file.