Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# Turning away the brutes (cont'd)

Tighten a bit for ssh, differentiate:

`/etc/pf.conf`

    table <bruteforce> persist

    block quick from <bruteforce>

    # tighter for ssh
    pass quick proto tcp from any to any port ssh \
            flags S/SA keep state \
            (max-src-conn 15, max-src-conn-rate 5/3, \
            overload <bruteforce> flush global)

    pass inet proto tcp from any to $int_if:network port $tcp_services \
            flags S/SA keep state \
    	(max-src-conn 100, max-src-conn-rate 15/5, \
             overload <bruteforce> flush global)