Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 10 Sep 2010 03:18:16 +1000 (EST)
From:      Ian Smith <smithi@nimnet.asn.au>
To:        Gareth de Vaux <bsd@lordcow.org>
Cc:        stable@freebsd.org
Subject:   Re: ipfw: Too many dynamic rules
Message-ID:  <20100910023132.E73353@sola.nimnet.asn.au>
In-Reply-To: <20100909153902.GA28341@lordcow.org>
References:  <20100909153902.GA28341@lordcow.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 9 Sep 2010, Gareth de Vaux wrote:
 > Hi again, I use some keep-state rules in ipfw, but get the following
 > kernel message:
 > 
 > kernel: ipfw: install_state: Too many dynamic rules
 > 
 > when presumably my state table reaches its limit (and I effectively
 > get DoS'd).
 > 
 > netstat shows tons of connections in FIN_WAIT_2 state, mostly to
 > my webserver. Consequently net.inet.ip.fw.dyn_count is large too.
 > 
 > I can increase my net.inet.ip.fw.dyn_max but the new limit will
 > simply be reached later on.

Try using 'limit' rather than the unlimited 'keep-state' for inbound 
dynamic connections to your server/s.  eg, derived from ipfw(8):

	ipfw add allow tcp from any to me 80 setup limit src-addr 4

".. can be placed on a server to make sure that a single client does not 
use more than 4 simultaneous connections."

You could add 'in recv $ext_if' to avoid limiting internal clients.

 > I currently get around this with a cronjob that sets
 > net.inet.ip.fw.dyn_keepalive to 0 for just less than 5 minutes
 > every night. If I leave it at 0 for longer or indefinitely then
 > idle ssh sessions and the like are dropped. This works fine for
 > me but it looks like there's some bug with net.inet.ip.fw.dyn_keepalive=1?
 > Or with Apache?

Limiting the number of source connections per source address to what 
apache is happy to deal with, you mightn't need to fuss with that?

cheers, Ian

 > I'm using 8.1-STABLE, GENERIC kernel. Experienced the same behaviour
 > on 8.0-RELEASE, but not on 6.1-RELEASE where I had a similar setup. I
 > have a KeepAliveTimeout of 4 in Apache (2.2.16).



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100910023132.E73353>