Re: Mitigating garbage requests & other connexion attempts

Hi Sylvain,

Use PF rules to overload IPs that connect too often into a black hole.  See pf.conf(5) man page, STATEFUL FILTERING topic, Stateful Tracking Options section, final example which uses overload.

block quick from <bad_hosts>
pass in on $ext_if proto tcp to $webserver port www keep state (max-src-conn-rate 100/10, overload <bad_hosts> flush global)

Same can be done for port ssh, except lower the rate to something that will catch the bad guys.

Cheers,
Brian

> On Aug 26, 2026, at 3:25 PM, Sylvain Saboua <[email protected]> wrote:
> 
> I remember when I first purchased my domain name and linked it
> to my fixed IP address, without having even published it anywhere yet,
> my /var/www/logs/access.log was full of attackers' weird requests.
> 
> The same thing happens in /var/log/authlog even with a nonstandard
> port for SSH forwarding. I suppose it would also be there in
> /var/log/maillog would I have set an email server up, and in other
> places.
> 
> I know Peter Hansteen has worked on the latter case:
> https://nxdomain.no/~peter/effective_spam_and_malware_countermeasures.html
> But I am left bare facing the excessive malicious activity on my
> httpd(8) and sshd(8) services.
> 
> So here's my question : is there a preferred / good practice way on
> OpenBSD to deflect attacker activity ? I'm not too worried about my
> system being penetrated, although one is never too careful, but I am
> regarding the workload this puts on my server and connexion.
> 
> Cheers
> --
> Sylvain Saboua
> looking for a PDP-11
>