Re: "Brutes" rules with UDP?

* Jordi Espasa Clofent <[email protected]> [2009-11-24 17:32]:
> >># SSH brutes protection
> >>pass quick on $bridge inet proto tcp from any to $vlan10  port 22
> >>keep state \
> >>        (max-src-conn 20, max-src-conn-rate 3/12, \
> >>        overload <ssh_brutes> flush global)
> >>
> >>with success. No problem, all works fine.
> >>
> >>I wonder if I can apply this type of rule to UDP connections (I try
> >>to protect some busy DNS servers)
> >
> >no, there's no way to avoid spoofed requests with UDP. if someone
> >sends a bunch of UDP packets spoofed from $BIG_ISP_RESOLVER's IP
> >address, their legitimate requests will be blocked.
> 
> I don't understand your response, Stuart.
> I wonder if the mentioned rule (using max-src-conn and max-src-rate)
> is also applicable to UDP-oriented connections as DNS is.

> >no,
^^^^^^

quite clear isn't it?

the tcp one works based on completed 3way handshakes. now think about
it. 

-- 
Henning Brauer, [email protected], [email protected]
BS Web Services, http://bsws.de
Full-Service ISP - Secure Hosting, Mail and DNS Services
Dedicated Servers, Rootservers, Application Hosting