PF - Treating Multiple Virtual IPs as one

Simon simon at optinet.com
Mon Oct 24 15:49:42 UTC 2016


I am trying to rate limit/control access to a port across multiple virtual IPs or aliases
using max-src-conn and max-src-conn-rate. Problem arises when attacker floods
connections to the same port across many IPs listening on the same port. Is it
possible to tell PF to treat connections to the same port across multiple IPs
assigned to the same NIC in the instances of max-src-conn-rate ? In other words,
I want connections made to port XX on x.x.x.1, x.x.x.2, etc... count toward the
same counter using max-src-conn-rate and max-src-conn. By default, each IP
tracks own counter and this defeats the purpose of my rate limiting for a port.
Couldn't find this in the manual.

Not sure if I'll have better luck with freebsd-ISP on this. Didn't want to cross post
just yet.

Thanks,
Simon




More information about the freebsd-questions mailing list