From owner-freebsd-stable@FreeBSD.ORG  Fri Sep 10 12:08:20 2010
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 40BC0106564A
	for <freebsd-stable@freebsd.org>; Fri, 10 Sep 2010 12:08:20 +0000 (UTC)
	(envelope-from freebsd-stable@m.gmane.org)
Received: from lo.gmane.org (lo.gmane.org [80.91.229.12])
	by mx1.freebsd.org (Postfix) with ESMTP id EF41F8FC08
	for <freebsd-stable@freebsd.org>; Fri, 10 Sep 2010 12:08:19 +0000 (UTC)
Received: from list by lo.gmane.org with local (Exim 4.69)
	(envelope-from <freebsd-stable@m.gmane.org>) id 1Ou2Ou-0001HB-4Q
	for freebsd-stable@freebsd.org; Fri, 10 Sep 2010 14:08:16 +0200
Received: from lara.cc.fer.hr ([161.53.72.113])
	by main.gmane.org with esmtp (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <freebsd-stable@freebsd.org>; Fri, 10 Sep 2010 14:08:16 +0200
Received: from ivoras by lara.cc.fer.hr with local (Gmexim 0.1 (Debian))
	id 1AlnuQ-0007hv-00
	for <freebsd-stable@freebsd.org>; Fri, 10 Sep 2010 14:08:16 +0200
X-Injected-Via-Gmane: http://gmane.org/
To: freebsd-stable@freebsd.org
From: Ivan Voras <ivoras@freebsd.org>
Date: Fri, 10 Sep 2010 14:08:06 +0200
Lines: 30
Message-ID: <i6d736$h9r$1@dough.gmane.org>
References: <20100909153902.GA28341@lordcow.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Complaints-To: usenet@dough.gmane.org
X-Gmane-NNTP-Posting-Host: lara.cc.fer.hr
User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US;
	rv:1.9.1.9) Gecko/20100518 Thunderbird/3.0.4
In-Reply-To: <20100909153902.GA28341@lordcow.org>
X-Enigmail-Version: 1.0.1
Subject: Re: ipfw: Too many dynamic rules
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Sep 2010 12:08:20 -0000

On 09/09/10 17:39, Gareth de Vaux wrote:
> Hi again, I use some keep-state rules in ipfw, but get the following
> kernel message:
>
> kernel: ipfw: install_state: Too many dynamic rules
>
> when presumably my state table reaches its limit (and I effectively
> get DoS'd).
>
> netstat shows tons of connections in FIN_WAIT_2 state, mostly to
> my webserver. Consequently net.inet.ip.fw.dyn_count is large too.
>
> I can increase my net.inet.ip.fw.dyn_max but the new limit will
> simply be reached later on.

For what it's worth, here's what I've been running:

net.inet.ip.fw.dyn_buckets=1024
net.inet.ip.fw.dyn_max=8192
net.inet.ip.fw.dyn_ack_lifetime=60

If in a tight spot, I might reduce dyn_ack_lifetime to 10.

There is no way this machine would service 8192 legitimate simultaneous 
connections so this works for me. If you have the memory I think you can 
increase dyn_max practically arbitrarily. If under a DDoS attack, you 
might run out of some other resource, like ephemeral TCP ports for the 
server side of connections, before running out of ipfw entries.