On Thu, 9 Sep 2010, Gareth de Vaux wrote:
> Hi again, I use some keep-state rules in ipfw, but get the following
> kernel message:
>
> kernel: ipfw: install_state: Too many dynamic rules
>
> when presumably my state table reaches its limit (and I effectively
> get DoS'd).
>
> netstat shows tons of connections in FIN_WAIT_2 state, mostly to
> my webserver. Consequently net.inet.ip.fw.dyn_count is large too.
>
> I can increase my net.inet.ip.fw.dyn_max but the new limit will
> simply be reached later on.
Try using 'limit' rather than the unlimited 'keep-state' for inbound
dynamic connections to your server/s. eg, derived from ipfw(8):
ipfw add allow tcp from any to me 80 setup limit src-addr 4
".. can be placed on a server to make sure that a single client does not
use more than 4 simultaneous connections."
You could add 'in recv $ext_if' to avoid limiting internal clients.
> I currently get around this with a cronjob that sets
> net.inet.ip.fw.dyn_keepalive to 0 for just less than 5 minutes
> every night. If I leave it at 0 for longer or indefinitely then
> idle ssh sessions and the like are dropped. This works fine for
> me but it looks like there's some bug with net.inet.ip.fw.dyn_keepalive=1?
> Or with Apache?
Limiting the number of source connections per source address to what
apache is happy to deal with, you mightn't need to fuss with that?
cheers, Ian
> I'm using 8.1-STABLE, GENERIC kernel. Experienced the same behaviour
> on 8.0-RELEASE, but not on 6.1-RELEASE where I had a similar setup. I
> have a KeepAliveTimeout of 4 in Apache (2.2.16).
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
