View Single Post
  #2   (View Single Post)  
Old 28th November 2017
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,984
Default

Hello, and welcome!

I'm not aware of any rate limiting capability for PF that uses PPS as a measure.

Traffic shaping (queueing) can be used to limit outbound bandwidth, rather than PPS. You could use this on any traffic you were forwarding from the 10.1.2.0/24 subnet to other networks.

You might be able to limit the number of UDP connections permitted, through a subset of of PF's Stateful Tracking Options, which are available for UDP traffic. UDP is stateless, but PF treats UDP as if it is stateful, using timers to track a limited form of state. You could limit the maximum number of "states" permitted to pass a specific rule, or you could limit the number of "states" by individual IP address within the rule, for example. See the STATEFUL TRACKING OPTIONS section of the pf.conf(5) man page for FreeBSD's PF, which I believe matches OpenBSD release 4.5 syntax. http://man.openbsd.org/OpenBSD-4.5/pf.conf
Reply With Quote