User Tools

Site Tools


Packet Filter Attack Mitigation


table <abusive_hosts> persist
block in quick from <abusive_hosts>

pass in on $ext_if proto tcp to $web_server port www \ 
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_hosts> flush)

Break it down line by line

  1. define a table to store abusive hosts
  2. block the abusive hosts
  3. pass traffic to the web server
  4. you need “flags S/SA keep state”
  5. if a host creates more than 100 at a time or creates 15 connections a sec it is placed in abusive_hosts
freebsd/pf_attack_mitigation.txt · Last modified: 2014/11/10 09:52 by tschulz