pf vs null route

[Gary Gatten]

Well, that's more "black holing" than null routing, but regardless,
routing will always be "faster"  / less cpu intensive than L4+
filtering.  Unless  of course the rules are compiled and executed in an
Asic like Ci$co does.  Anyway, whether or not the processing latency is
noticeable to the users only time will tell.

This is a never ending battle.  Force your users to make stronger
passwords and implement an automated password recovery process for them.
Your webserver SHOULD be able to blacklist IP's that do bad things
automatically as well.

If you have another "good" solution let me know.  With all the spoofing,
bots, etc. - it's VERY difficult to block access without causing
problems for legitimate users.

One thing pf would allow is a sort of "tar pit"  / rate limiting vs.
100% block like a black-hole.  This way if you accidentally trigger an
"enforce" action on a legit user, the'll just run slow for a little
while instead of being blocked entirely.

G



-----Original Message-----
From: owner-freebsd-questions at freebsd.org
[mailto:owner-freebsd-questions at freebsd.org] On Behalf Of Doug Hardie
Sent: Monday, June 15, 2009 4:47 PM
To: freebsd-questions -
Subject: pf vs null route

My web server is always being attacked by people trying to guess our  
user's passwords.  Most of the time the ids they try are not in use so  
there is only a log entry and a bit of packet time involved.  However,  
eventually they are likely to guess a valid id and password.  Some of  
our users have very weak passwords.  Granted they will only be able to  
get to the user's personal web space, but that would be inconvenient  
for the user.

For a long time I have been using null routes for the persistent  
attacks (set a route of 127.0.0.2 for their adddress in the route  
table).  This works fine.  We still get the first SYN packet, but  
nothing after that.  I do have pf running on several of our servers  
for other purposes and have been thinking about replacing the null  
routes with a blocking table using pf.  The question is which scales  
better?  My guess based on presumed implementation techniques is that  
pf will scale better.  I currently have a table for incoming mail that  
has over 100K entries and there is no noticable effect on mail  
processing times.  Unfortunately I can't tell if that is because I  
also don't have any good way to determine if there were any effects.   
pf would certainly provide additional capabilites, but given the  
limited use of this server, I don't see any need for anything more.   
Since we provide telnet and ftp access for users to their personal web  
pages, I keep anything important on another server.
_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
"freebsd-questions-unsubscribe at freebsd.org"





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
 and may contain information that is privileged and/or confidential.
 If you are not the intended recipient, you are hereby notified that
 any review, use, dissemination, disclosure or copying of this email
 and its attachments, if any, is strictly prohibited.  If you have
 received this email in error, please immediately notify the sender by
 return email and delete this email from your system."
</font>