Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# overloading to a tiny queue

    pass log quick on $ext_if proto tcp from any to any port ssh flags S/SA \
    keep state queue (ssh_bulk, ssh_interactive)

becomes

    pass log quick on $ext_if proto tcp from any to any port ssh flags S/SA \
    keep state (max-src-conn 15, max-src-conn-rate 5/3, \
         overload <bruteforce> flush global) \
         queue (ssh_bulk, ssh_interactive)

where

    queue smallpipe bandwidth 1% cbq

and

    pass inet proto tcp from <bruteforce> to any \
         port $tcp_services queue smallpipe