Date: 26 Apr 2002 06:33:28 -0400 From: Dan Pelleg <dpelleg+bsd@cs.cmu.edu> To: "Crist J. Clark" <cjc@FreeBSD.ORG> Cc: Gregory Neil Shapiro <gshapiro@FreeBSD.ORG>, "Rex A. Roof" <rex@gunjin.wccnet.org>, freebsd-ipfw@FreeBSD.ORG Subject: Re: Putting in place an incoming sendmail limit Message-ID: <u2s1yd2iwav.fsf@gs166.sp.cs.cmu.edu> In-Reply-To: <20020425232444.B34367@blossom.cjclark.org> References: <200204252052.g3PKqrj0090391@gunjin.wccnet.org> <15560.29198.657946.738003@horsey.gshapiro.net> <20020425232444.B34367@blossom.cjclark.org>
next in thread | previous in thread | raw e-mail | index | archive | help
"Crist J. Clark" <cjc@FreeBSD.ORG> writes: > On Thu, Apr 25, 2002 at 02:15:58PM -0700, Gregory Neil Shapiro wrote: > > rex> In order to prevent incoming DoS attacks via multiple sendmail > > rex> connections, I've tried adding the following ipfw rule: > > > > rex> allow tcp from any to any smtp limit src-addr 1 > > > > rex> This works great, except that when it's triggered I get A LOT > > rex> of messages like this: > > > > rex> OUCH! cannot remove rule, count 1 > > rex> drop session, too many entries > > > > Perhaps it is because that rule matches every packet into of just the TCP > > setup packet. You might try using the 'setup' keyword. (Just a guess). > > That's probably not the problem. Remember 'limit' rules are dynamic > rules. > > What version of FreeBSD are you running? I believe the 'OUCH!' is > luigi's way of saying that you shouldn't be seeing that error. It > indicates an internal error. It is, and it's been discussed on this mailing list before. I have a patch for this, which I've discussed with luigi in the past. For some reason, I never heard back from him after posting it. This way or the other, it's here if you want to apply it yourself: http://www.freebsd.org/cgi/query-pr.cgi?pr=32600 -- Dan Pelleg To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?u2s1yd2iwav.fsf>