Re: "Brutes" rules with UDP?

>> # SSH brutes protection
>> pass quick on $bridge inet proto tcp from any to $vlan10  port 22
>> keep state \
>>         (max-src-conn 20, max-src-conn-rate 3/12, \
>>         overload <ssh_brutes> flush global)
>>
>> with success. No problem, all works fine.
>>
>> I wonder if I can apply this type of rule to UDP connections (I try
>> to protect some busy DNS servers)
> 
> no, there's no way to avoid spoofed requests with UDP. if someone
> sends a bunch of UDP packets spoofed from $BIG_ISP_RESOLVER's IP
> address, their legitimate requests will be blocked.

I don't understand your response, Stuart.
I wonder if the mentioned rule (using max-src-conn and max-src-rate) is 
also applicable to UDP-oriented connections as DNS is.

So,

pass quick on $bridge inet proto udp from any to $vlan10  port 53
	keep state \
        (max-src-conn 30, max-src-conn-rate 2/1, \
         overload <dns_brutes> flush global)

¿it will be work?

-- 
I must not fear. Fear is the mind-killer. Fear is the little-death that 
brings total obliteration. I will face my fear. I will permit it to pass 
over me and through me. And when it has gone past I will turn the inner 
eye to see its path. Where the fear has gone there will be nothing. Only 
I will remain.

Bene Gesserit Litany Against Fear.