I just did some testing; you are correct, the syntax permits overload to be specified but pfctl(8) will insist on max-src-conn or max-src-conn-rate. Nor will pfctl permet max-src-conn or max-src-nodes set to 0.
If you want to create a honeypot using PF as designed, you're going to have to permit at least one connection. Consider redirecting traffic to a tarpit listener.
|