PF How to rate limit ping?

L

~Luna

I could use some help with a pf firewall I can't get to work. For some reason, ping/icmp won't get blocked by overload.

This works for ssh connections:
Code: 
table <bruteforce> persist
block drop in log quick on $ext_if inet proto tcp from <bruteforce> port 22
pass in log on $ext_if inet proto tcp to port 22 keep state (max-src-conn 15, max-src-conn-rate 3/1, overload <bruteforce> flush global)

This does exactly what I would expect it do do: when a source IP sends more than 3 requests over TCP/22 in 1 second, the IP gets added to <bruteforce>, the connection drops and the source IP can't make new connections. But something similar for ICMP (echoreq) just won't work:
Code: 
table <blacklistping> persist
block drop in log quick on $ext_if from <blacklistping>
pass in log on $ext_if inet proto icmp icmp-type { echoreq unreach } keep state (max-src-conn 3, max-src-conn-rate 1/10, overload <blacklistping> flush global)

1/10 (1 per 10 seconds) should be a pretty aggressive setting, but even when sending 100 ping requests in 1 second, they all just get answered without getting blocked. The source IP for some reason doesn't get added to the <blacklistping> table.

Anyone any idea what I'm doing wrong? Thanks in advance for any help!
 
There is no "connection" with ICMP. TCP uses the so-called "three-way handshake" (SYN; SYN/ACK; ACK) to make a connection.
 
Ah, that actually makes sense! I would like to rate limit ping to 1/s per source IP, is this possible in some other way?
 
Alain De Vos said:
Maybe,
forums.freebsd.org

is there any way to solve this - Limiting icmp ping response ....

Hello guys I have this problem. I am running apinger on my freebsd router for simple monitoring the connectivity to different kind of hosts (local and internet). But when someone in the network tries very intensive pings to my router, freebsd automaticaly limits the icmp rate and thus the...
forums.freebsd.org forums.freebsd.org
Click to expand...
Thanks. I already use a low setting for net.inet.icmp.icmplim, but the thing is: some source IP addresses should be able to ping more often than 1/s, while the internet shouldn't have that ability (on these servers). Also I like to have some logging. So I figured I create rules allowing a table with allowed IP's to send a lot of pings, while any other source IP will be blocked fairly fast. The pipe thing mentioned might be something to check out, thanks!
 
You must log in or register to reply here.
Back
Top