Am 26.08.2026 um 21:22 schrieb Sylvain Saboua: > So here's my question : is there a preferred / good practice way on > OpenBSD to deflect attacker activity ? I'm not too worried about my > system being penetrated, although one is never too careful, but I am > regarding the workload this puts on my server and connexion. > > Cheers
There is no general rule of thumb nor one rule fits them all for things like this. I ran into a similar situation a few weeks ago. Also discussed it on @misc. See the archives. From that experience I'd suggest taking a close look at the resources requested. After having spent days trying to figure out how to prevent a "sucking the blood out of the system" situation I started using firewall rules employing blocking and rate limiting based on geo location and asn. I even wrote a small utility for this when a linux box got hit by this that hard I had to take down the http service [1]. Those requests also "looked like" being related to ai but turned out to be unrelated to anything ai. The machine happened to serve various Trac instances. Those were attacked intentionally because that software seems to be known to be exploitable easily. Blocking lots of asn and various countries has helped a lot finding the root cause of the requests. In the end I did not need to add support for generating pf configuration files to it at all. Things like this best be done at bpg level, imho. [1] <https://github.com/ChristianSchulte/csv2etc> Regards, -- Christian
