From owner-freebsd-ipfw@freebsd.org  Thu May  4 21:46:28 2017
Return-Path: <owner-freebsd-ipfw@freebsd.org>
Delivered-To: freebsd-ipfw@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 398CFD5E753
 for <freebsd-ipfw@mailman.ysv.freebsd.org>;
 Thu,  4 May 2017 21:46:28 +0000 (UTC) (envelope-from marco@tols.org)
Received: from tolstoy.tols.org (tolstoy-a1.tols.org [IPv6:2a02:898:57:3::1])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits)) (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 0A3B7B19
 for <freebsd-ipfw@freebsd.org>; Thu,  4 May 2017 21:46:27 +0000 (UTC)
 (envelope-from marco@tols.org)
Received: from [2a02:898:57:1:6d68:35bc:71cb:c1d6]
 by tolstoy.tols.org with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
 (Exim 4.87_1 (FreeBSD)) (envelope-from <marco@tols.org>)
 id 1d6OZr-0007yl-Sa; Thu, 04 May 2017 23:46:23 +0200
From: Marco van Tol <marco@tols.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: equivalent for pf's max-src-conn-rate in ipfw
Message-Id: <F6AA6A38-CA06-49E8-AD8D-F6D8E4C26523@tols.org>
Date: Thu, 4 May 2017 23:46:21 +0200
Cc: Marco van Tol <marco@tols.org>
To: freebsd-ipfw@freebsd.org
X-Mailer: Apple Mail (2.3273)
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw/>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
 <mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 04 May 2017 21:46:28 -0000

Hi there,

Possibly this questions pops up regularly.  I have tried to find the =
answer myself and have been unable to so far.

My current way to drastically slow-down ssh brute force attacks is by =
using the pf feature "max-src-conn-rate" with an argument of 5/60 =
meaning only 5 syn packets are allowed per source IP to my ssh port per =
minute.  The rest get dropped.  This works both for IPv4 and IPv6.  I =
typically don't login more then 5 times per minute to my hosts.

I have tried several ways to get the same behaviour using ipfw and =
dummynet.  But when combining the rules with keep-state I don't get to =
the point where I get wire-speed ssh connections for those that make it =
while keeping the number of new connections per source IP at a very low =
number (a few per minute).

Is there an equivalent in ipfw for the pf feature max-src-conn-rate?

Thank you very much in advance, please keep cc'ing me as I have not =
subscribed to the ipfw list yet.

Thanks!

Marco van Tol=