Re: pf max-src-{states,conn} without overload/flush useless?

2023-02-13 Thread joshua stein
On Thu, 09 Feb 2023 at 11:51:19 +0100, Alexandr Nedvedicky wrote: > I gave it a try after doing a sysupgrade to: > > penBSD 7.2-current (GENERIC.MP) #1025: Wed Feb 8 19:16:09 MST 2023 > > it still works for me as expected: > disk$ for i in `seq 5` ; do nc 192.168.2.175 22 & done >

Re: pf max-src-{states,conn} without overload/flush useless?

2023-02-09 Thread Alexandr Nedvedicky
Hello, On Wed, Feb 08, 2023 at 09:42:11PM -0600, joshua stein wrote: > $ for i in `seq 5` ; do nc 192.168.1.240 22 & done > [2] 68892 > [3] 6303 > [4] 63554 > [5] 87833 > [6] 49997 > $ SSH-2.0-OpenSSH_9.1 > SSH-2.0-OpenSSH_9.1 > SSH-2.0-OpenSSH_9.1 > SSH-2.0-OpenSSH_9.1 > SSH-2.0-OpenSSH_9.1 >

Re: pf max-src-{states,conn} without overload/flush useless?

2023-02-08 Thread joshua stein
On Thu, 09 Feb 2023 at 02:42:22 +0100, Alexandr Nedvedicky wrote: > this is my test terminal on remote host: > router$ for i in `seq 5` ; do nc 192.168.2.175 22 & done > [1] 32472 > [2] 97453 > [3] 7192 > [4] 50386 > [5] 57517 > router$ SSH-2.0-OpenSSH_9.1 >

Re: pf max-src-{states,conn} without overload/flush useless?

2023-02-08 Thread Alexandr Nedvedicky
Hello, I did test similar rules on my system OpenBSD 7.2-current (GENERIC.MP) #978: Sun Jan 22 11:41:04 MST 2023 these are my rules: set skip on lo block return# block stateless traffic pass out log# establish keep-state pass in on iwn0 proto tcp from

pf max-src-{states,conn} without overload/flush useless?

2023-02-08 Thread joshua stein
I want to limit incoming connections on a server to 5 per IP. I don't want to put violators into a pf table (overload) or kill the other connections (flush), I just want to not accept new connections from that IP once their limit is reached and then accept them again when they are under the