Hi,
I wish to make so: for that that the port ssh for certain IP would open,
it is necessary in the beginning will be knocked on other port.
While I have written about such rules:
block all
pass in quick on $int_if inet proto tcp from any to $int_if port http
keep state (max-src-conn-rate 1/60, overload <sshen>)
pass quick inet proto tcp from <sshen> to $int_if port ssh
They work, but there are some things not arranging me:
- If to change port http for any other empty port (on http post, I have
working apache) source IP does not get in the table though state it is
created.
- To be knocked it is necessary two times:) since max-src-conn-rate it
is not allowed to set a zero.
Somebody was engaged in similar distortions?
Or somebody knows as to solve this task in another with PF?
Best regards, GReenX.
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
