12 lines
1018 B
Plaintext
12 lines
1018 B
Plaintext
|
table <bad> persist
|
||
|
|
block drop all
|
||
|
|
block drop quick from <bad> to any
|
||
|
|
pass out proto tcp all flags S/SA keep state
|
||
|
|
pass out proto icmp all keep state
|
||
|
|
pass out proto udp all keep state
|
||
|
|
pass in on lo1000001 inet proto tcp from any to 10.0.0.1 port = ssh flags S/SA keep state (source-track rule, max-src-conn 10, max-src-conn-rate 3/99, src.track 99)
|
||
|
|
pass in on lo1000001 inet proto tcp from any to 10.0.0.2 port = ssh flags S/SA keep state (source-track rule, max-src-conn 10)
|
||
|
|
pass in on lo1000001 inet proto tcp from any to 10.0.0.3 port = ssh flags S/SA keep state (source-track rule, max-src-conn-rate 3/99, src.track 99)
|
||
|
|
pass in on lo1000000 inet proto tcp from any to 10.0.0.1 port = http flags S/SA modulate state (source-track rule, max-src-conn 100, max-src-conn-rate 10/5, overload <bad> flush, src.track 5)
|
||
|
|
pass in on lo1000000 inet proto tcp from any to 10.0.0.1 port = 8080 flags S/SA synproxy state (source-track rule, max-src-conn 1000, max-src-conn-rate 1000/5, overload <bad> flush global, src.track 5)
|