Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# State tracking (cont)

Prevent floods:

    pass inet proto tcp from any to $webserver port www \
            flags S/SA keep state \
    	(max-src-conn-rate 15/5, \
             max-src-nodes 250, max-src-states 100, source-track rule)

`max-src-nodes`: number of distinct hosts (IP addresses) allowed to have states

`max-src-states`: number of states allowed per host

Others simply dropped