急求PF限连接数方法

sjfff99

第1步：设置一个暴力攻击嫌疑的列表，凡是连接总是超过设定值或者单位时间内连接突发速率超过设定值的都视为可疑对象
table <bad_ip> persist

第2步：针对暴力攻击嫌疑对象设置相应的处理规则
block quick from <bad_ip>

第3步：设置相关连接限制
pass in on $int_if inet proto {tcp,udp} from any to any keep state (max-src-conn 100, max-src-conn-rate 15/5, overload <bad_ip> flush)

根本不起作用。
查看后。不是有大量的连接数
IP:192.168.0.250 Connections:123
IP:192.168.0.31 Connections:155
IP:192.168.0.38 Connections:134
IP:192.168.0.39 Connections:157
IP:192.168.0.48 Connections:112
IP:192.168.0.54 Connections:180
IP:192.168.0.55 Connections:150
IP:192.168.0.56 Connections:332
IP:192.168.0.60 Connections:201
IP:192.168.0.63 Connections:425
IP:192.168.0.65 Connections:343
IP:192.168.0.68 Connections:108
IP:192.168.0.82 Connections:325
IP:192.168.0.85 Connections:187
IP:192.168.0.89 Connections:216
IP:192.168.0.95 Connections:106
IP:192.168.0.97 Connections:272
IP:192.168.0.99 Connections:137

sjfff99

后修改
table <work_ip> {192.168.0.0/24,!192.168.0.1}

block in quick from <bad_ip>

pass in quick on $int_if inet proto tcp from <work_ip> to any keep state (max-src-conn 200, max-src-conn-rate 50/5, overload
<bad_ip> flush)

这样直接打不开网页了。有知道怎么解决吗？

剑心通明

table <abusive_hosts> persist
block in quick from <abusive_hosts>
pass in on $ext_if proto tcp to $web_server port www flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_hosts> flush)

这样的应该可以啊，看看这里http://www.bsdlover.cn/html/42/n-642.html，有详细的解释

sjfff99

table <work_ip> {192.168.0.0/24,!192.168.0.1}


block in quick from <bad_ip>



pass in quick on $ext_if1 inet proto {tcp,udp} from <work_ip> to any keep state
(max-src-conn 100, max-src-conn-rate 20/5, overload <bad_ip> flush)
pass in quick on $ext_if2 inet proto {tcp,udp} from <work_ip> to any keep state
(max-src-conn 100, max-src-conn-rate 20/5, overload <bad_ip> flush)

但是没效果呀

IP:192.168.0.11 Connections:480
IP:192.168.0.22 Connections:136
IP:192.168.0.47 Connections:110
IP:192.168.0.78 Connections:1153
IP:192.168.0.82 Connections:142
IP:192.168.0.87 Connections:271
IP:192.168.0.90 Connections:613
IP:192.168.0.96 Connections:297


在加了一条限内网的。
pass in quick on $int_if inet proto {tcp,udp} from <work_ip> to any keep state (max-src-conn 100, max-src-conn-rate 20/5, overload <bad_ip> flush)
立马网页打不开了。。。

gihnius

IP:192.168.0.250 Connections:123
IP:192.168.0.31 Connections:155
IP:192.168.0.38 Connections:134
IP:192.168.0.39 Connections:157
IP:192.168.0.48 Connections:112
IP:192.168.0.54 Connections:180
IP:192.168.0.55 Connections:150
IP:192.168.0.56 Connections:332
IP:192.168.0.60 Connections:201
IP:192.168.0.63 Connections:425
IP:192.168.0.65 Connections:343
IP:192.168.0.68 Connections:108
IP:192.168.0.82 Connections:325
IP:192.168.0.85 Connections:187

请问 你上面这些是统计活动连接吗?

zeissoctopus

凡路由不需要經過 pf 的路由器，那麼你一切所定的 pf 規則皆不會起作用

sjfff99

这话是什么意思，不经过PF的路由器？。。不太明白。。。

zeissoctopus

．．．．．．．．．．．．．．．．

zeissoctopus

回复 7# sjfff99

这话是什么意思，不经过PF的路由器？。。不太明白。。。
sjfff99 发表于 2011-07-21 21:55

内网  与  Web Server 之间 如果有交换器，当内网任何一点，知道 Web Server 的位址后，你认为内网需不需要先路过  PF 才绕回去 Web Server ?

你問防火墙规则之前，宜先交待一下实际如果接线，防火墙规则，只会对出入防火墙封包起作用，如果封包有别的途径绕过防火墙，你的内网规则都是徒然。

zeissoctopus

table  {192.168.0.0/24,!192.168.0.1}

在加了一条限内网的。
pass in quick on $int_if inet proto {tcp,udp} from <work_ip> to any keep state (max-src-conn 100, max-src-conn-rate 20/5, overload <bad_ip> flush)
立马网页打不开了。。。

我的假设：如果你的 PF 正是 192.168.0.1，并把 192.168.0.0/24 的 DNS 指向 192.168.0.1 的话

现在你把 192.168.0.1 排除出 work_ip 之外，并把 192.168.0.1 栏截去任何地方，包括 192.168.0.0/24。结果好清楚了，你把 DNS 都一并栏截，什么地方都去不到