pf vs. RST attack question
Jeremy Chadwick
koitsu at FreeBSD.org
Mon Oct 6 00:36:03 UTC 2008
On Sun, Oct 05, 2008 at 12:53:03PM -0500, Scott Bennett wrote:
> I'm getting a lot of messages like this:
>
> Oct 4 14:30:00 hellas kernel: Limiting closed port RST response from 250 to 200 packets/sec
>
> Is there some rule I can insert into /etc/pf.conf to reject these apparently
> invalid RST packets before they can bother TCP? At the same time, I do not
> want to reject legitimate RST packets.
They're outbound RST packets coming from your box as a result of
incoming packets someone is sending you (possibly an attack).
Proper firewalling rules should help defeat this, but there is no "magic
rule" you can place into pf.conf that will stop this.
If you want a "magic solution", see blackhole(4).
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. PGP: 4BD6C0CB |
More information about the freebsd-questions
mailing list