DaemonForums  

Go Back   DaemonForums > FreeBSD > FreeBSD Security

FreeBSD Security Securing FreeBSD.

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1   (View Single Post)  
Old 14th July 2009
chazz chazz is offline
New User
 
Join Date: Jul 2009
Posts: 2
Thanked 0 Times in 0 Posts
Default PF Rules for DoS

Below is a packet filter snippet from my config file:

Code:
block drop log quick from <brute>
...
pass in  quick on $ext_if proto tcp from any to <webs> port 80 flags S/SA keep state (max-src-conn 80, max-src-conn-rate 200/2, overload <brute> flush global)
pass out quick on $int_if proto tcp from any to <webs> port 80 flags S/SA keep state

pass out quick on $ext_if proto tcp from <webs> port 80   to any flags SA/SA keep state
pass in  quick on $int_if proto tcp from <webs> port 80   to any flags SA/SA keep state

Question 1:
Should the bruteforce rules be on each line, or just that first one?

Question 2:
If they should be on each line, should I multiply the values (80, 200/2) by 4 ?

Question 3:
Are the rates I'm using reasonable? blocking should be on the loose side


I'm open to any thoughts, opinions or screams on best practices
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Help with pf rules TerranAce007 OpenBSD General 4 16th January 2009 10:14 PM
PF wont open port despite rules... Dain_L OpenBSD Security 3 12th September 2008 01:14 AM
ipfw rules not behaving Weaseal FreeBSD Security 5 13th August 2008 01:22 PM
PF/ALTQ rules not working as intended Weaseal FreeBSD Security 4 6th August 2008 12:41 PM
flush natd rules nenduvel FreeBSD Security 1 3rd May 2008 08:59 PM


All times are GMT. The time now is 03:49 PM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick