WAN load balancer configurations always add a default 5 packet/sec limit to the nftables rules, despite code being present to remove them.
Configuration:
matthew@VyOS# compare
+ load-balancing {
+ wan {
+ flush-connections
+ interface-health eth1 {
+ failure-count "5"
+ nexthop "dhcp"
+ test 10 {
+ target "1.1.1.1"
+ type "ping"
+ }
+ test 20 {
+ target "8.8.8.8"
+ type "ping"
+ }
+ }
+ interface-health eth2 {
+ failure-count "5"
+ nexthop "dhcp"
+ test 10 {
+ target "1.1.1.1"
+ type "ping"
+ }
+ test 20 {
+ target "8.8.8.8"
+ type "ping"
+ }
+ }
+ interface-health eth3.666 {
+ failure-count "5"
+ nexthop "dhcp"
+ test 10 {
+ target "1.1.1.1"
+ type "ping"
+ }
+ test 20 {
+ target "8.8.8.8"
+ type "ping"
+ }
+ }
+ rule 10 {
+ destination {
+ address "!192.168.0.0/16"
+ }
+ inbound-interface "eth4.10"
+ interface eth1 {
+ }
+ interface eth2 {
+ }
+ }
+ rule 20 {
+ destination {
+ address "!192.168.0.0/16"
+ }
+ inbound-interface "eth4.50"
+ interface eth1 {
+ }
+ interface eth2 {
+ }
+ }
+ rule 110 {
+ destination {
+ address "!192.168.0.0/16"
+ }
+ inbound-interface "eth4.10"
+ interface eth3.666 {
+ }
+ }
+ rule 120 {
+ destination {
+ address "!192.168.0.0/16"
+ }
+ inbound-interface "eth4.50"
+ interface eth3.666 {
+ }
+ }
+ sticky-connections {
+ inbound
+ }
+ }
+ }nftables:
matthew@VyOS:~$ show wan-load-balance status iifname "eth1" ct state new ct mark set 0x000000c9 iifname "eth2" ct state new ct mark set 0x000000ca iifname "eth3.666" ct state new ct mark set 0x000000cb iifname "eth4.10" ip daddr != 192.168.0.0/16 ct state new limit rate 5/second burst 5 packets counter packets 25 bytes 1602 jump wlb_mangle_isp_eth1 iifname "eth4.50" ip daddr != 192.168.0.0/16 ct state new limit rate 5/second burst 5 packets counter packets 0 bytes 0 jump wlb_mangle_isp_eth1 iifname "eth4.10" ip daddr != 192.168.0.0/16 ct state new limit rate 5/second burst 5 packets counter packets 25 bytes 1608 jump wlb_mangle_isp_eth3.666 iifname "eth4.50" ip daddr != 192.168.0.0/16 ct state new limit rate 5/second burst 5 packets counter packets 0 bytes 0 jump wlb_mangle_isp_eth3.666