Re: pf blocking active connections

2013-02-08 Thread Stuart Henderson
On 2013-02-08, Martijn van Duren wrote: > On Fri, 2013-02-08 at 08:23 +, Stuart Henderson wrote: >> On 2013-02-07, Martijn van Duren wrote: >> > Thanks for all the quick responses, but if I understand you all >> > correctly there is no way to cut off an established connection by adding >> > a

Re: pf blocking active connections

2013-02-08 Thread Martijn van Duren
On Fri, 2013-02-08 at 08:23 +, Stuart Henderson wrote: > On 2013-02-07, Martijn van Duren wrote: > > Thanks for all the quick responses, but if I understand you all > > correctly there is no way to cut off an established connection by adding > > an ip address to a blocked table, so I'm still l

Re: pf blocking active connections

2013-02-08 Thread James Griffin
--> patrick keshishian [2013-02-07 12:16:40 -0800]: > look in 'man pfctl' and search for killing active sessions. > > > On Thu, Feb 7, 2013 at 12:13 PM, Martijn van Duren > wrote: > > Hello misc, > > > > Today I watch the current connections on my small home server and I > > noticed an unfami

Re: pf blocking active connections

2013-02-08 Thread Stuart Henderson
On 2013-02-07, Martijn van Duren wrote: > Thanks for all the quick responses, but if I understand you all > correctly there is no way to cut off an established connection by adding > an ip address to a blocked table, so I'm still left with my two stage > drop off the connection (both adding the th

Re: pf blocking active connections

2013-02-07 Thread Ville Valkonen
On Feb 7, 2013 11:20 PM, "Jan Stary" wrote: > > On Feb 07 21:31:11, martijn...@gmail.com wrote: > > Thanks for all the quick responses, but if I understand you all > > correctly there is no way to cut off an established connection by adding > > an ip address to a blocked table, so I'm still left w

Re: pf blocking active connections

2013-02-07 Thread Jan Stary
On Feb 07 21:31:11, martijn...@gmail.com wrote: > Thanks for all the quick responses, but if I understand you all > correctly there is no way to cut off an established connection by adding > an ip address to a blocked table, so I'm still left with my two stage > drop off the connection (both adding

Re: pf blocking active connections

2013-02-07 Thread Scott McEachern
On 02/07/13 15:31, Martijn van Duren wrote: Thanks for all the quick responses, but if I understand you all correctly there is no way to cut off an established connection by adding an ip address to a blocked table, so I'm still left with my two stage drop off the connection (both adding the the i

Re: pf blocking active connections

2013-02-07 Thread Martijn van Duren
Thanks for all the quick responses, but if I understand you all correctly there is no way to cut off an established connection by adding an ip address to a blocked table, so I'm still left with my two stage drop off the connection (both adding the the ip to the table and killing the connection manu

Re: pf blocking active connections

2013-02-07 Thread Scott McEachern
On 02/07/13 15:13, Martijn van Duren wrote: Hello misc, Today I watch the current connections on my small home server and I noticed an unfamiliar ftp-connection. Upon inspecting the connection I noticed it was a brute force attack, so I fired up my pfctl-utility and tried to block the attack by

Re: pf blocking active connections

2013-02-07 Thread patrick keshishian
look in 'man pfctl' and search for killing active sessions. On Thu, Feb 7, 2013 at 12:13 PM, Martijn van Duren wrote: > Hello misc, > > Today I watch the current connections on my small home server and I > noticed an unfamiliar ftp-connection. Upon inspecting the connection I > noticed it was a

pf blocking active connections

2013-02-07 Thread Martijn van Duren
Hello misc, Today I watch the current connections on my small home server and I noticed an unfamiliar ftp-connection. Upon inspecting the connection I noticed it was a brute force attack, so I fired up my pfctl-utility and tried to block the attack by adding the ip to my quick drop table. After ad