Re: PF block log all and ddos issue

2012-12-28 Thread Theron ZORBAS
Sorry my last post is broken: You can see my outputs at : http://pastebin.com/FtbfHXf8 Thanks. From: Theron ZORBAS To: James Shupe ; "misc@openbsd.org" Sent: Friday, December 28, 2012 11:00 PM Subject: Re: PF block log all and ddos issue Hi again

Re: PF block log all and ddos issue

2012-12-28 Thread Theron ZORBAS
udp 53 requests which are just attack. Thanks. From: James Shupe To: misc@openbsd.org Sent: Friday, December 28, 2012 8:11 PM Subject: Re: PF block log all and ddos issue > But i still wonder why my firewall freezes when > logging all blocked udp 53 requests

Re: PF block log all and ddos issue

2012-12-28 Thread James Shupe
> But i still wonder why my firewall freezes when > logging all blocked udp 53 requests. > The attack is not too heavy. I had seen > much worse before. > - Check interrupt usage - Check states to make sure the reason it seems unresponsive isn't due to the state table being full Without more infor

Re: PF block log all and ddos issue

2012-12-28 Thread Theron ZORBAS
when logging all blocked udp 53 requests. The attack is not too heavy. I had seen much worse before. Anyway, thanks. From: Peter N. M. Hansteen To: Theron ZORBAS Cc: "misc@openbsd.org" Sent: Thursday, December 27, 2012 7:43 PM Subject: Re: PF blo

Re: PF block log all and ddos issue

2012-12-27 Thread Kevin Chadwick
On Thu, 27 Dec 2012 18:43:44 +0100 pe...@bsdly.net (Peter N. M. Hansteen) wrote: > As default i wanna log which packet my firewall blocked. > > > > So how can i > > log all blocked packets and my firewall can be still up and > > running? Hopefully I will never need them but I have various pf co

Re: PF block log all and ddos issue

2012-12-27 Thread Peter N. M. Hansteen
Theron ZORBAS writes: > I have an OpenBSD 5.2 i386 firewall. It was running so good till > last night. > We are under a ddos attack(DNS Amplification attack) (ANY? isc.org > requests) First of all, unless you *want* to run an open resolver, reconfigure so only the ones you want to do recursion f

PF block log all and ddos issue

2012-12-27 Thread Theron ZORBAS
Hello Misc, I have an OpenBSD 5.2 i386 firewall. It was running so good till last night. We are under a ddos attack(DNS Amplification attack) (ANY? isc.org requests) Our firewall freezes. I cant ping to my firewall interfaces even internal interface. It doesnt answer maybe replies very slowly. Bef