From owner-freebsd-questions@FreeBSD.ORG Wed May 4 14:54:26 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3403816A50F for ; Wed, 4 May 2005 14:54:26 +0000 (GMT) Received: from rwcrmhc13.comcast.net (rwcrmhc13.comcast.net [204.127.198.39]) by mx1.FreeBSD.org (Postfix) with ESMTP id D38F943D41 for ; Wed, 4 May 2005 14:54:25 +0000 (GMT) (envelope-from stevenrhowe@comcast.net) Received: from lucky7 (c-24-147-47-215.hsd1.nh.comcast.net[24.147.47.215]) by comcast.net (rwcrmhc13) with SMTP id <200505041453460150050fo3e>; Wed, 4 May 2005 14:53:50 +0000 From: "Steven R Howe" To: "'Alex Teslik'" , Date: Wed, 4 May 2005 10:53:17 -0400 Message-ID: <000101c550b9$04b17e00$020a0a0a@lucky7> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2616 In-Reply-To: <20050504021412.M91151@acatysmoof.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal Subject: RE: dynamically limit ip connections to ports over time? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 May 2005 14:54:26 -0000 Alex, You may want to consider using an IDS such as Snort. There is a plugin called SnortSam (www.snortsam.net) which will accomplish what you want to do. Here is text copied from the front page of their website: "SnortSam is a plugin for Snort, an open-source light-weight Intrusion Detection System (IDS). The plugin allows for automated blocking of IP addresses on following firewalls: # Checkpoint Firewall-1 # Cisco PIX firewalls # Cisco Routers (using ACL's or Null-Routes) # Former Netscreen, now Juniper firewalls # IP Filter (ipf), available for various Unix-like OS'es such as FreeBSD # FreeBSD's ipfw2 (in 5.x) # OpenBSD's Packet Filter (pf) # Linux IPchains # Linux IPtables # Linux EBtables # WatchGuard Firebox firewalls # 8signs firewalls for Windows # MS ISA Server firewall/proxy for Windows # CHX packet filter # ...and more to come There are several other programs in the ports collection. But I recommend Snort. Good Luck!!! -----Original Message----- From: owner-freebsd-questions@freebsd.org [mailto:owner-freebsd-questions@freebsd.org] On Behalf Of Alex Teslik Sent: Tuesday, May 03, 2005 10:33 PM To: freebsd-questions@freebsd.org Subject: dynamically limit ip connections to ports over time? Hi all, I have been running a FreeBSD box for a few years. Over this time spammers and other unfriendlies have found my box and have been attacking at a slowly increasing rate. Every night the daily periodic scripts run and report to me the number of rejected mail hosts. Last week, one of the rejected mail hosts had the number of rejections listed at 3000. My hard drive has been getting louder and louder as it gets busier rejecting and logging all of these and now I would like to do something about it... but I'm not sure what I can do. When the hard drive is at its busiest I see mail being virus and spam scanned at a dizzying rate (tail -f /var/log/maillog), hence the hard drive grinding. What I would LIKE to do is allow any ip to connect to a port for a specified number of times per minute. If they connect too many times than I would like to freeze them out for a specified amount of time. This solution should be dynamic so that I don't need to constantly monitor the offending ip addresses. Originally, I thought I would attach a sendmail milter to do this, since mail cannons are my main problem right now. I looked at: http://www.milter.info/milter-limit/index.shtml but it requires manually adding a rule for each ip. Then I considered grey-listing: http://www.milter.info/milter-gris/index.shtml but I don't want to reject messages and cause mail delivery delays on my system. Finally, it occurred to me that the firewall would probably be a better solution and would have the nice side effect of limiting traffic to other ports as well. To try to accomplish this I have been reading a lot of IPFilter rules via google and lists, but I havn't found any that seems that it can do what I describe above - limit by ip over time. I'm sure this is not a unique problem - can someone point me in a helpful direction? Many Thanks P.S.- please cc my email address as I am not subscribed. _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.11.0 - Release Date: 4/29/2005