> On Tue, Oct 23, 2007 at 02:55:41PM -0700, Rob wrote:
> > > On Sun, Oct 21, 2007 at 02:22:43PM -0500, david l goodrich wrote:
> > > > I've set up a max-src-conn-rate rule on my gateway router to
> > > > mitigate brute-force ssh attacks. This router protects a /28
> > > > subnet, 25.108.82.80/28.
> > > >
> > > > The relevant rules:
> > > >
> > > > # pfctl -sr | grep attack
> > > > block drop in log quick proto tcp from to any
> > > > pass in log proto tcp from any to any port = ssh keep state
> > > > (source-track rule, max-src-conn-rate 3/30, overload
> > > > flush global, src.track 30)
> > > > #
> >
> > I'm not a pf newbie by any means, but I'm not really qualified to
> > answer questions about it either. That said, I don't usually use an
> > '=' sign in my pf rules, and the pf faq doesn't list that as one of
> > the accepted operators for the port range
> > (
http://www.openbsd.org/faq/pf/filter.html). If the rule wasn't being
> > parsed correctly, it would cause the behavior you're seeing. Try,
>
> I don't have an = sign in my rule, either, i have it in pf.conf as:
>
> pass in log proto tcp from any to any port ssh \
> keep state (max-src-conn-rate 3/30, \
> overload flush global)
>
> but when i look at my rules with pfctl -sr it shows the =.
>
> >
> > block in log quick proto tcp port ssh keep state \
> > (source-track rule, max-src-conn-rate 3 / 30 overload
> > , src.track 30)
>
> I want to pass ssh traffic by default, so a block rule won't be
> terribly helpful.
