ipfw, keep-state and limit

[Ivan Voras]

I think I need to start filtering based on simultaneous connections from
source IP addresses because of some abuse that's apparently going on,
so, as I'm already using ipfw, I tried this:

# ipfw add 6079 allow tcp from any to me 80 setup keep-state limit
src-addr 10

To which ipfw replied:

ipfw: only one of keep-state andlimit is allowed

(including the "andlimit" typo).

What I'm trying to do makes sense to me (and seems straightforward to
implement, at least semantically): allow connections to port 80 with
dynamic keep-state rules for individual clients, but allow only 10
connections from the same address. Is this a limitation in ipfw? Any
suggestions?

This is a 6-STABLE PAE+SMP machine.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20070415/a7e71e88/signature.pgp