Re: Mitigating garbage requests & other connexion attempts

Sylvain & Brian,

I have a VPS which gets hundreds of attempts to get in via ssh using a password every hour. Those all get banned for 1 day. Repeat attempts get added to my <gropers> table in pf, which has over 4000 entries. I also block all connection attempts from AWS, Digital Ocean, Azure, Akamai, Cloudflare, fastly, Google, linode, oracle, and zscaler (via their published lists of IPv4 and IPv6 addresses).

After almost a year of adding to my lists, and then consolidating addresses into CIDR blocks, I have about 30% of all IPv4 address space blocked. It’s maybe cut the connection attempt rate, as seen in authlog, in half.

As this server is basically just for my use, I'm looking into setting it up with authpf(8) gating all http/https access. If you're attempting to make a public-facing server, I'm not sure how I would go about it today. One person I know is reporting that more than 99.9% of all http connections on his formerly low-volume server are AI scrapers. He's deployed iocaine-powder on it so if nothing else he can know that he's poisoning their models in exchange for the added bandwidth bills.

Good luck. I hope you find (and report back) a good solution, but the internet seems a much more hostile place than when I started using OpenBSD almost three decades ago. Me, I'm reconsidering the wisdom of having anything available outside my LAN.

-DaveP

On Wed, Aug 26, 2026, at 14:32, Brian Brombacher wrote:
> Hi Sylvain,
>
> Use PF rules to overload IPs that connect too often into a black hole.  
> See pf.conf(5) man page, STATEFUL FILTERING topic, Stateful Tracking 
> Options section, final example which uses overload.
>
> block quick from <bad_hosts>
> pass in on $ext_if proto tcp to $webserver port www keep state 
> (max-src-conn-rate 100/10, overload <bad_hosts> flush global)
>
> Same can be done for port ssh, except lower the rate to something that 
> will catch the bad guys.
>
> Cheers,
> Brian
>
>> On Aug 26, 2026, at 3:25 PM, Sylvain Saboua <[email protected]> wrote:
>> 
>> I remember when I first purchased my domain name and linked it
>> to my fixed IP address, without having even published it anywhere yet,
>> my /var/www/logs/access.log was full of attackers' weird requests.
>> 
>> The same thing happens in /var/log/authlog even with a nonstandard
>> port for SSH forwarding. I suppose it would also be there in
>> /var/log/maillog would I have set an email server up, and in other
>> places.
>> 
>> I know Peter Hansteen has worked on the latter case:
>> https://nxdomain.no/~peter/effective_spam_and_malware_countermeasures.html
>> But I am left bare facing the excessive malicious activity on my
>> httpd(8) and sshd(8) services.
>> 
>> So here's my question : is there a preferred / good practice way on
>> OpenBSD to deflect attacker activity ? I'm not too worried about my
>> system being penetrated, although one is never too careful, but I am
>> regarding the workload this puts on my server and connexion.
>> 
>> Cheers
>> --
>> Sylvain Saboua
>> looking for a PDP-11
>>