Sets and variables state that changes while the rules run.

Sets

size N sets the capacity, from 1 to 100000000. The default is 65536; for a set loaded from a file it is at least twice the number of entries. ttl D (addresses sets only, at least 1s) makes entries expire.

An addresses set is a least recently used map: when it is full it forgets old entries rather than refusing new ones. The kernel keeps its free entries per CPU, so a very small set, fewer than about a hundred entries per CPU, can forget entries before it is full. Give sets room.

A set file holds one address or prefix per line. # starts a comment, blank lines are ignored, a UTF-8 BOM and CRLF line endings are accepted, and file paths are relative to the .moat file.

An IPv4-mapped address or prefix, such as ::ffff:192.0.2.1 (the way programs listening on [::] log IPv4 clients), means the IPv4 one. The whole mapped range, ::ffff:0:0/96 as bogon lists carry it, stays IPv6, as it would in a rule; it does not turn into all of IPv4.

Variables

var udp_limit = 5000
var under_attack = false

rule strict { when under_attack and udp.dport != 27015 then drop }
rule udp_flood { when udp then limit udp_limit/s per ip.src burst 10000 }

A variable holds a number or true/false. A true/false variable is a condition on its own. A number can be compared with an integer field (==, !=, <, <=, >, >=, not in) and used as the rate or the burst of a limit. A rate of 0 turns the limit off; a burst of 0 lets no packet through below the rate. Used in a limit, a variable holds at most 1000000000, and so does a burst written next to a variable rate.

Values are read for every packet, so moat var set changes behaviour at once. load starts from the values in the file; reload keeps the current value of every variable that still exists with the same kind, unless the new rules use it where that value does not fit. Then it goes back to the file's value, and reload says so: "variable X held a value the new rules cannot use and is back to the file's".