Date: Thu, 21 Aug 2008 14:10:51 -0700 From: security <security@jim-liesl.org> To: Mikhail Teterin <mi+mill@aldan.algebra.com> Cc: freebsd-security@freebsd.org Subject: Re: machine hangs on occasion - correlated with ssh break-in attempts Message-ID: <48ADD9DB.8060805@jim-liesl.org> In-Reply-To: <48ADC7E7.9030907@aldan.algebra.com> References: <48ADA81E.7090106@aldan.algebra.com> <B9E94DF3-52B5-4A5E-9BDF-18773F34DF91@neely.cx> <48ADC7E7.9030907@aldan.algebra.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Mikhail Teterin wrote: > Neil Neely ΞΑΠΙΣΑΧ(ΜΑ): >> I haven't explored this issue enough to speak with any authority - >> but once upon a time I had an app doing tons of ipfw rule add/removes >> all the time and we had no end of performance and stability problems >> on that box (this would have been in 4.x or so timeline I expect). >> As that approach wasn't really critical we abandoned it without >> really digging into the details. >> >> Years later a need for lots of rapid firewall changes came up again >> and I drilled into it and found the use of tables was excellent for >> doing this and it does the job very well. This is approach is on a >> FreeBSD 6.3 box. >> >> ipfw add 00550 deny ip from 'table(1)' to any >> >> Then just add remove entries to table 1 via: >> ipfw table 1 add 10.1.1.22/32 >> ipfw table 1 delete 10.1.1.22/32 >> >> show all entries in table 1 with: >> ipfw table 1 list >> >> Clear out the whole of table 1 >> ipfw table 1 flush >> >> I can't be sure if this relates to your particular issue, but I would >> recommend trying it out. > Thanks! I was not even aware of this functionality... Yes, I'll try > that -- maybe, a bug in ipfw only hits once per 1000 invocations :-) > > -mi blocksshd uses pf and a table to contain the addresses. you might want to check it out
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48ADD9DB.8060805>