PF Stateful Tracking Limitation Options

An example rule:

pass in on $ext_if proto tcp to $web_server \
    port www keep state \
    (max 200, source-track rule, max-src-nodes 100, max-src-states 3)

The rule above defines the following behavior:

• Limit the absolute maximum number of states that this rule can create to 200
• Enable source tracking; limit state creation based on states created by this rule only
• Limit the maximum number of nodes that can simultaneously create state to 100
• Limit the maximum number of simultaneous states per source IP to 3

A separate set of restrictions can be placed on stateful TCP connections that have completed the 3-way handshake.

max-src-conn number

Limit the maximum number of simultaneous TCP connections which have completed the 3-way handshake that a single host can make.

max-src-conn-rate number / interval

Limit the rate of new connections to a certain amount per time interval.

Both of these options automatically invoke the source-track rule option and are incompatible with source-track global.
Since these limits are only being placed on TCP connections that have completed the 3-way handshake, more aggressive actions can be taken on offending IP addresses.

overload <table>

Put an offending host's IP address into the named table.

flush [global]

Kill any other states that match this rule and that were created by this source IP. When global is specified, kill all states matching this source IP, regardless of which rule created the state.

An example:

table <abusive_hosts> persist
block in quick from <abusive_hosts>

pass in on $ext_if proto tcp to $web_server \
    port www flags S/SA keep state \
    (max-src-conn 100, max-src-conn-rate 15/5, overload <abusive_hosts> flush)

This does the following:

• Limits the maximum number of connections per source to 100
• Rate limits the number of connections to 15 in a 5 second span
• Puts the IP address of any host that breaks these limits into the <abusive_hosts> table
• For any offending IP addresses, flush any states created by this rule.

REFERENCES:

http://www.openbsd.org/faq/pf/filter.html#stateopts

http://kestas.kuliukas.com/pf.conf/

pftop filter specific pattern

-f filter. for example:

pftop -f 'src host 172.30.26.34'

access logging with pf

1) edit /etc/pf.conf, then run #pfctl -f /etc/pf.conf. Of course you also have to determine $ and <> variables first.


# Ignore IGMP log
# You can add this line if many IGMP packets bothering you.
pass in on $int_if proto igmp all allow-opts

# Port mapping

pass in log on $ext_if proto tcp from <access_list> to $ext_ip port 22 rdr-to $inside_server_ip port 22

2) view pf log as follows.

# tcpdump -n -e -ttt -r /var/log/pflog

Port mapping & NAT with pf

1) edit /etc/sysctl.conf to enable packet forwarding first. Then reboot.

net.inet.ip.forwarding=1        # 1=Permit forwarding (routing) of IPv4 packets

2) edit /etc/pf.conf, and run #pfctl -f /etc/pf.conf.

# Port mapping

pass in on $ext_if proto tcp from any to $ext_ip port 80 rdr-to $inside_server_ip port 80

# NAT rules

# This is not necessary because the stateful pf will add it automatically with rdr-to rules.

# pass out on $ext_if from $inside_server_ip port 80 to any nat-to $ext_if

monitor real-time connections with pftop

1) edit .profile in /root, add the following line. And also execute it immediately. Change the version and architecture according to your situation.

export PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/5.1/packages/amd64/

2) run #pkg_add -r pftop.

3) run #pftop, then you get all tcp/udp connections through your openbsd box!