mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Backend and support for allow limiting of TCP connections by establishment rate

Browse Source 
Useful for protecting against sudden outburts, etc.
This commit is contained in:
Scott Ullrich 2005-05-04 04:02:24 +00:00
parent 15ae8170e0
commit ed08ef3ea3
2 changed files with 28 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
etc/inc/filter.inc
View File

@ -1287,7 +1287,6 @@ function generate_user_filter_rule($rule, $ngcounter) {
if( isset($rule['source-track']) or isset($rule['max-src-nodes']) or isset($rule['max-src-states']) )
if($rule['protocol'] == "tcp")
$line .= "flags S/SA ";
/*
# keep state
works with TCP, UDP, and ICMP.
@ -1327,10 +1326,11 @@ function generate_user_filter_rule($rule, $ngcounter) {
$line .= "max-src-states " . $rule['max-src-states'] . " ";
if(isset($rule['statetimeout']) & $rule['statetimeout'] <> "")
$line .= "tcp.established " . $rule['statetimeout'] . " ";
if(isset($rule['max-src-conn-rate']) & $rule['max-src-conn-rate'] <> "")
if(isset($rule['max-src-conn-rate']) & $rule['max-src-conn-rate'] <> ""
and isset($rule['max-src-conn-rates']) & $rule['max-src-conn-rates'] <> "") {
$line .= "max-src-conn-rate " . $rule['max-src-conn-rate'] . " ";
if(isset($rule['max-src-conn-rates']) & $rule['max-src-conn-rates'] <> "")
$line .= "/" . $rule['max-src-conn-rates'] . ", overload <virusprot> flush global ";
$line .= "/" . $rule['max-src-conn-rates'] . ", overload <virusprot> flush global ";
}
$line .= " ) ";
}
}

28
usr/local/www/firewall_rules_edit.php
View File

@ -155,10 +155,16 @@ if (isset($id) && $a_filter[$id]) {
$pconfig['disabled'] = isset($a_filter[$id]['disabled']);
$pconfig['log'] = isset($a_filter[$id]['log']);
$pconfig['descr'] = $a_filter[$id]['descr'];
/* advanced */
$pconfig['max-src-nodes'] = $a_filter[$id]['max-src-nodes'];
$pconfig['max-src-states'] = $a_filter[$id]['max-src-states'];
$pconfig['statetype'] = $a_filter[$id]['statetype'];
$pconfig['statetimeout'] = $a_filter[$id]['statetimeout'];
/* advanced - new connection per second banning*/
$pconfig['max-src-conn-rate'] = $a_filter[$id]['max-src-conn-rate'];
$pconfig['max-src-conn-rates'] = $a_filter[$id]['max-src-conn-rates'];
} else {
/* defaults */
@ -352,6 +358,9 @@ if ($_POST) {
$a_filter[] = $filterent;
}
$filterent['max-src-conn-rate'] = $_POST['max-src-conn-rate'];
$filterent['max-src-conn-rates'] = $_POST['max-src-conn-rates'];
write_config();
touch($d_filterconfdirty_path);
@ -781,18 +790,29 @@ Hint: the difference between block and reject is that with reject, a packet (TCP
<br> <span class="vexpl">You may enter a description here
for your reference (not parsed).</span></td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell">Advanced Options</td>
<td width="78%" class="vtable">
<input name="max-src-nodes" id="max-src-nodes" value="<?php echo $pconfig['max-src-nodes'] ?>"><br> Simultaneous client connection limit<p>
<input name="max-src-states" id="max-src-states" value="<?php echo $pconfig['max-src-states'] ?>"><br> Maximum state entries per host<p>
<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo $pconfig['max-src-conn-rate'] ?>"> /
<select name="max-src-conn-rates" id="max-src-conn-rates">
<option value=""<?php if($pconfig['max-src-conn-rates'] == "") echo " selected"; ?>></option>
<?php
for($x=0; $x<255; $x++) {
if($x == $pconfig['max-src-conn-rates'])
$selected = " selected";
else
$selected = "";
echo "<option value=\"{$x}\"{$selected}>{$x}</option>\n";
}
?>
</select>
<br>
New connections / per second
<p><strong>NOTE: Leave these fields blank to disable this feature.</strong>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell">State Type</td>
<td width="78%" class="vtable">