Re: overload rule for outgoing floods

2012-07-12 Thread Boutros Halingrad
On Wed, Jul 11, 2012 at 6:59 PM, Matthew Dempsky matt...@dempsky.orgwrote: On Wed, Jul 11, 2012 at 4:44 AM, Boutros Halingrad boutros.haling...@gmail.com wrote: Problem is, the only address that get added to the floodtargets table is that of the sending server. Right, sys/net/pf.c is

overload rule for outgoing floods

2012-07-11 Thread Boutros Halingrad
Hello all, I know this is really stupid, but I'm trying to mitigate the effects of one hacked server on our (very large) network that is being used to DoS other computers on the Internet. I do not have access to the server and I cannot take it down (due to different reasons), so instead I'm

Re: overload rule for outgoing floods

2012-07-11 Thread Mihai Popescu
Any ideas on how to get the attack victims added to the table? Thanks, Boutros Hire a consultant specialised in OpenBSD firewall, before the damaged part will sue you.

Re: overload rule for outgoing floods

2012-07-11 Thread Matthew Dempsky
On Wed, Jul 11, 2012 at 4:44 AM, Boutros Halingrad boutros.haling...@gmail.com wrote: Problem is, the only address that get added to the floodtargets table is that of the sending server. Right, sys/net/pf.c is hardcoded to use only the source address for the overload table. (Search for