RE: Source Tracking in PF
Cheers Ryan!
This is a big step towards DDoS proofing OpenBSD!
Dom
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dom De Vitto Tel. 07855 805 271
http://www.devitto.com mailto:[EMAIL PROTECTED]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Ryan McBride
Sent: Monday, December 15, 2003 12:24 AM
To: [EMAIL PROTECTED]
Subject: Source Tracking in PF
I just committed code which adds support to track stateful connections by
source IP address. This allows a user to:
- Ensure that clients get a consistent IP mapping with load-balanced
translation/routing rules
- Limit the number of simultaneous connections a client can make
- Limit the number of clients which can connect through a rule
As always, the more people who test this and provide feedback, the happier I
am. Read below for details.
-Ryan
SYNTAX:
The 'sticky-address' keyword applies to translation rules; the translation
address will be selected from the list, but once a client makes a
connection, all subsequent connections are translated the same way.
nat on $ext_if from $int_net to any - \
{ 10.1.2.1, 10.1.2.3 } round-robin sticky-address
Similarly in the following case, connections to a server are mapped
randomly, but all connections from a client are mapped the same way.
rdr on $ext_if from any to $ext_if - \
{ 192.168.0.4/30 } random sticky-address
In the case of tracking states per rule, the syntax is slightly different.
The 'source-track' state option is used to enable tracking, limits can also
be set there: 'max-src-states' limits how many states from a single source
can exist simultaneously and 'max-src-nodes'
limits how many source nodes can exist (effectively this is a limit on how
many clients can connect at once).
The following rule allows a maximum of 1000 source ip's to connect to a
webserver, each with a maximum of 3 simultaneous states:
pass in on $ext_if proto tcp to $webserver port www flags S/SA \
keep state (source-track, max-src-states 3, max-src-nodes 10)
By default, the source node is removed when all the states which reference
it are removed. However the timeout 'src.track' regulates how long the
source node is retained after all it's states have died.
set timeout src.track 900
A list of src nodes can be retrived with pfctl -sS, pfctl -vsS; pfctl -vsi
provides statistics on src-node useage (similar to the statistics provided
for states)
Re: Source Tracking in PF
On Sun, Dec 14, 2003 at 07:29:14PM -0800, Peter Hessler wrote: I was wondering if there was a way to use similar rules with ALTQ. E.G. Evenly split a queue for each source-ip on a /24. Allow each to use unused bandwidth, but guarantee each gets a fair percentage (in this example, each ip gets 6k/sec, and can borrow). this is called WFQ and is used inside each CBQ queue always...
Source Tracking in PF
I just committed code which adds support to track stateful connections
by source IP address. This allows a user to:
- Ensure that clients get a consistent IP mapping with load-balanced
translation/routing rules
- Limit the number of simultaneous connections a client can make
- Limit the number of clients which can connect through a rule
As always, the more people who test this and provide feedback, the
happier I am. Read below for details.
-Ryan
SYNTAX:
The 'sticky-address' keyword applies to translation rules; the
translation address will be selected from the list, but once a client
makes a connection, all subsequent connections are translated the same
way.
nat on $ext_if from $int_net to any - \
{ 10.1.2.1, 10.1.2.3 } round-robin sticky-address
Similarly in the following case, connections to a server are mapped
randomly, but all connections from a client are mapped the same way.
rdr on $ext_if from any to $ext_if - \
{ 192.168.0.4/30 } random sticky-address
In the case of tracking states per rule, the syntax is slightly
different. The 'source-track' state option is used to enable tracking,
limits can also be set there: 'max-src-states' limits how many states
from a single source can exist simultaneously and 'max-src-nodes'
limits how many source nodes can exist (effectively this is a limit
on how many clients can connect at once).
The following rule allows a maximum of 1000 source ip's to connect to a
webserver, each with a maximum of 3 simultaneous states:
pass in on $ext_if proto tcp to $webserver port www flags S/SA \
keep state (source-track, max-src-states 3, max-src-nodes 10)
By default, the source node is removed when all the states which
reference it are removed. However the timeout 'src.track' regulates
how long the source node is retained after all it's states have died.
set timeout src.track 900
A list of src nodes can be retrived with pfctl -sS, pfctl -vsS;
pfctl -vsi provides statistics on src-node useage (similar to the
statistics provided for states)
Re: Source Tracking in PF
On Mon, 15 Dec 2003 00:23:58 +
Ryan McBride [EMAIL PROTECTED] wrote:
:I just committed code which adds support to track stateful connections
:by source IP address. This allows a user to:
:- Ensure that clients get a consistent IP mapping with load-balanced
: translation/routing rules
:- Limit the number of simultaneous connections a client can make
:- Limit the number of clients which can connect through a rule
:
:As always, the more people who test this and provide feedback, the
:happier I am. Read below for details.
:
:-Ryan
:
:
:
[snip kick ass syntax]
I was wondering if there was a way to use similar rules with ALTQ. E.G.
Evenly split a queue for each source-ip on a /24. Allow each to use unused
bandwidth, but guarantee each gets a fair percentage (in this example,
each ip gets 6k/sec, and can borrow). Something like:
...
altq on $ext_if bandwidth 2Mb cbq { emp, serv, dflt }
queue server bandwidth 15%
queue emp bandwidth 80%
queue dflt bandwidth 5% cbq(default)
pass out on $ext_if from 192.169.1.0/24 to any keep state queue emp (
source-split)
(source-split doesn't exist, but I made it up, to be a semi-reasonable
place for the syntax)
Thanks for the great work!
--
Job Placement, n.:
Telling your boss what he can do with your job.
