Re: pf block port scanning

2021-10-11 Thread Stuart Henderson
On 2021-10-10, Peter N. M. Hansteen wrote: > On Sun, Oct 10, 2021 at 02:48:04PM +0300, Barbaros Bilek wrote: >> Hello Peter, >> >> I think you suggest me some work around like max-src-conn-rate, right? > > I would think both the rate and the number of simultaneous connections could > be relevant

Re: pf block port scanning

2021-10-10 Thread Peter N. M. Hansteen
On Sun, Oct 10, 2021 at 02:48:04PM +0300, Barbaros Bilek wrote: > Hello Peter, > > I think you suggest me some work around like max-src-conn-rate, right? I would think both the rate and the number of simultaneous connections could be relevant here, yes. - Peter -- Peter N. M. Hansteen, member

Re: pf block port scanning

2021-10-10 Thread Barbaros Bilek
Hello Peter, I think you suggest me some work around like max-src-conn-rate, right? On Sat, Oct 9, 2021 at 5:07 PM Peter Nicolai Mathias Hansteen < pe...@bsdly.net> wrote: > > > > 7. okt. 2021 kl. 15:58 skrev Barbaros Bilek : > > > > Hello misc, > > > > I try to block port scanning attempts with

Re: pf block port scanning

2021-10-10 Thread Barbaros Bilek
Hi Stuart, I have 'block log all' as a rule and yes i have several ports that are open. I was told to take precautions against port scanning. I'm trying to achieve that too. :/ On Sat, Oct 9, 2021 at 4:13 PM Stuart Henderson wrote: > On 2021-10-07, Barbaros Bilek wrote: > > Hello misc, > > > >

Re: pf block port scanning

2021-10-09 Thread Peter Nicolai Mathias Hansteen
> 7. okt. 2021 kl. 15:58 skrev Barbaros Bilek : > > Hello misc, > > I try to block port scanning attempts with OpenBSD 6.9/amd64 + PF. > At the top of my pf.conf i've added these lines but it didn't work. > > block in quick proto tcp all flags SF/SFRA label bps1 > block in quick proto tcp all

Re: pf block port scanning

2021-10-09 Thread Stuart Henderson
On 2021-10-07, Barbaros Bilek wrote: > Hello misc, > > I try to block port scanning attempts with OpenBSD 6.9/amd64 + PF. > At the top of my pf.conf i've added these lines but it didn't work. > > block in quick proto tcp all flags SF/SFRA label bps1 > block in quick proto tcp all flags FPU/SFRAUP