Date: Thu, 23 Nov 2006 11:14:13 -0800 From: "Jon Simola" <jsimola@gmail.com> To: "John Smith" <almarrie@gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: rate limit with pf instead of IPFW Message-ID: <8eea04080611231114u52612661md86d4ff9781f5d1c@mail.gmail.com> In-Reply-To: <499c70c0611231101k68429053l40ec68712ca66263@mail.gmail.com> References: <499c70c0611231047k84747frf91def08d509cba6@mail.gmail.com> <8eea04080611231059x6e229d09lfd3f25965511d7ee@mail.gmail.com> <499c70c0611231101k68429053l40ec68712ca66263@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 11/23/06, John Smith <almarrie@gmail.com> wrote:
> > > Could someone please give me full example to setup
> > > limit {src-addr | src-port | dst-addr | dst-port} to do what IPFW
> > > 01000 allow tcp from any to me setup limit src-addr 5 currently does
> Could you please post your pf.conf with the rules so I can use it as a guide?
A complete and working pf.conf that limits all inbound tcp connections
to 5 per source ip address would be:
pass in proto tcp all flags S/SA keep state (source-track rule,
max-src-states 5)
Yes, just that one line. Obviously you need some more rules around
that, and the PF User's Guide at
http://www.openbsd.org/faq/pf/index.html will do a far better job of
explaining it than I could in a short email.
--
Jon
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8eea04080611231114u52612661md86d4ff9781f5d1c>