From owner-freebsd-pf@FreeBSD.ORG Sun Nov 9 10:03:24 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0DE141065673 for ; Sun, 9 Nov 2008 10:03:24 +0000 (UTC) (envelope-from omasnjak@gmail.com) Received: from wf-out-1314.google.com (wf-out-1314.google.com [209.85.200.171]) by mx1.freebsd.org (Postfix) with ESMTP id D851B8FC0A for ; Sun, 9 Nov 2008 10:03:23 +0000 (UTC) (envelope-from omasnjak@gmail.com) Received: by wf-out-1314.google.com with SMTP id 24so1924080wfg.7 for ; Sun, 09 Nov 2008 02:03:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=UsoxTQMh1a2d8vwnQFHzGoZoxCta9M8LF2oSiSnpxFo=; b=h3K8ddPbIldlGQv2ekucLiGnbXfLb4OLVjgTlFo1pfudANxkI6tvT0h+3EOgqSuCzs eXOiATEEBzNOTTvofXuPMO887ZCpHExA8HGAB2E1kfy+LZOVVzgEcTwkJFqJGfMbkeBe UKeNuqs+iR3hiuqjE+qj2RpgamR0oFR6KF7Fc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=Cw2BJTAX5/Oe7XE98aPixVk48Ymy9rp3ZLFoUPwbCd7B5+XyYLS6DsmSMT1veRnLX4 p9VWHSx8vvynrMEhm8/JPqIZ3CtjXC6RIvfyEybL28M+34RPceOvqG1KMf9fzhVX1X23 9+3XdCQuOsII9Vx9ilgomGHahgU5CLLAi32Dg= Received: by 10.142.163.1 with SMTP id l1mr1742423wfe.263.1226223449735; Sun, 09 Nov 2008 01:37:29 -0800 (PST) Received: by 10.143.93.6 with HTTP; Sun, 9 Nov 2008 01:37:29 -0800 (PST) Message-ID: <1814bfe70811090137v39cd6434l49b545eb3b6eb88c@mail.gmail.com> Date: Sun, 9 Nov 2008 10:37:29 +0100 From: "Elvir Kuric" To: freebsd-pf@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: Blocking udp flood trafiic using pf, hints welcome X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Nov 2008 10:03:24 -0000 Hi all, I am playing with pf tool on openbsd/freebsd platforms and it is super tool for firewalls. On thing is interesting for me, and I am hopping someone has expeience with this. If I say block log all block in log (all) quick on $ext_if proto udp from any to $ext_if this would block all traffic on $ext_if, but on my ext_if I recive a lot of ( huge amount ) of udp generated traffic which make me a lot of problems. I also tryed to add small pipe and play with ALTQ to handle this but it did not help a lot. Also I know that every packet which hit my ext_if should be processed ( or least take a little processor resources, if I block it with keyword quick ), but I am wondering is there some way to decrease impact on system when a lot of packets arive in short time. My question would be, what are your experinces with battling against boring udp flooders ? Platform are FreeBSD / OpenBSD and all works like a charm except time to time, stupid udp flood atacks. Any suggestion is welcome, With Regards, Elvir Kuric