From owner-freebsd-questions@FreeBSD.ORG  Wed Oct 15 20:21:13 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 1187D1065689
	for <freebsd-questions@freebsd.org>;
	Wed, 15 Oct 2008 20:21:13 +0000 (UTC)
	(envelope-from clarkp@mtmary.edu)
Received: from fear.mtmary.edu (rrcs-74-62-87-82.west.biz.rr.com [74.62.87.82])
	by mx1.freebsd.org (Postfix) with ESMTP id E206F8FC16
	for <freebsd-questions@freebsd.org>;
	Wed, 15 Oct 2008 20:21:12 +0000 (UTC)
	(envelope-from clarkp@mtmary.edu)
Received: from [127.0.0.1] (war.mtmary.edu [172.16.0.200])
	by fear.mtmary.edu (Postfix) with ESMTP id 979F3539420
	for <freebsd-questions@freebsd.org>;
	Wed, 15 Oct 2008 12:00:51 -0500 (CDT)
Message-ID: <48F621C2.8080405@mtmary.edu>
Date: Wed, 15 Oct 2008 12:00:50 -0500
From: Peter Clark <clarkp@mtmary.edu>
User-Agent: Thunderbird 2.0.0.17 (Windows/20080914)
MIME-Version: 1.0
To: FreeBSD Questions <freebsd-questions@freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: PF syntax error
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Oct 2008 20:21:13 -0000

Hello,

I am not sure if I should be here or over at a pf specific list but here 
is my problem.

I am trying my hand at pf on a 7.0-p5 RELEASE box and one rule is giving 
me problems.

pass in quick on $ext_if proto tcp from any to any port 22 flags S/SA \ 

  (max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush 
global)

Actually the "pass in" line does not generate the error. The next line does.

/etc/pf.conf:71: syntax error
If I remove the line the error goes away (obviously). I have tried using 
  the exact line from the FreeBSD pf.conf man page:

(max-src-conn-rate 100/10, overload <bad_hosts> flush global)

(I changed <bad_hosts> to <bruteforce>)and that generates the same 
error. I tried just using:
(max-src-conn-rate 100/10)

but that too gives me a syntax error.

Any help is appreciated.

Peter Clark