nftables tar-pit

{ config, lib, ... }: { networking.nftables = { ruleset = ''  table inet filter {  # 1. Define the dynamic set for Fail2ban to feed into  set banned_tarpit {  type ipv4_addr  flags timeout  }  chain inbound {  type filter hook input priority filter; policy accept;  # 2. Match banned IPs and drop them into an isolated SYN proxy  # This tricks their TCP stack into a perpetual handshake validation loop  ip saddr @banned_tarpit tcp flags syn tcp dport { 80, 443 } notrack  }  }  # 3. Handle the stateless tracking bypass  table inet raw {  chain prerouting {  type filter hook prerouting priority raw; policy accept;  ip saddr @banned_tarpit tcp dport { 80, 443 } tcp flags syn synproxy mss 1460 wscale 0  }  }  ''; }; }