OpenBSD Journal

Source Tracking in PF

Contributed by jose on from the new-features dept.

I saw a new feature has been added to PF : 

Subject:  Source Tracking in PF
From:     Ryan McBride

Date:     2003-12-15 0:23:58

I just committed code which adds support to track stateful connections
by source IP address. This allows a user to:
- Ensure that clients get a consistent IP mapping with load-balanced
  translation/routing rules
- Limit the number of simultaneous connections a client can make
- Limit the number of clients which can connect through a rule

As always, the more people who test this and provide feedback, the
happier I am. Read below for details.

-Ryan
Read Ryan's mail for a longer description of how to do this. Those of you multihoming or load balancing with PF are going to love this.

(Comments are closed)

Comments

  1. By Anonymous Coward () on

    I am specially thinking about all the guys in the apache and www-servers newsgroups asking how to limit the number of simultaneous connections to Apache :-)
    Thanks!

    Comments

    1. By Anonymous Coward () on

      Isn't there already this option, something like tcp.100 or tcp(100) something like this. I'm just going by memory.

    2. By Anonymous Coward () on

      Which is not so good since alot of people sits behind NAT gateways.

  2. By gwyllion () on

    I saw an other new feature has been added to PF :
    Add initial support for pf state synchronization over the network.
    Implemented as an in-kernel multicast IP protocol.

    Turn it on like this:

    # ifconfig pfsync0 up syncif fxp0

    There is not yet any authentication on this protocol, so the syncif must be on a trusted network. ie, a crossover cable between the two firewalls.

  3. By Anonymous Coward () on

    From the email example...

    The following rule allows a maximum of 1000 source ip's to connect to a webserver, each with a maximum of 3 simultaneous states: pass in on $ext_if proto tcp to $webserver port www flags S/SA keep state (source-track, max-src-states 3, max-src-nodes 10)

    Shouldn't that be "max-src-nodes 1000" instead of 10? Just wanting to make sure I understood the example correctly. :)

    Comments

    1. By Foxy () foxy@free.fr on http://foxy.free.fr

      Shouldn't that be "max-src-nodes 1000" instead of 10? Just wanting to make sure I understood the example correctly. You understand correctly : with "max-src-nodes 10", it's a maximum of 10 (NOT 1000) source ip's that be able to connect to the server.

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]