Skip to content

Instantly share code, notes, and snippets.

@noqqe

noqqe/pf.conf

Created June 9, 2013 14:26
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save noqqe/5743740 to your computer and use it in GitHub Desktop.
Save noqqe/5743740 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
pf.conf
# Block anything
block in all
block out all
block return
# Anti SSH Bruteforce
table <bruteforce> persist
table <admins> { 1.2.3.4/32 }
# Disallow bruteforcing IPs except <admins>
pass in on $extif from <admins> to any port ssh
block quick from <bruteforce>
# Allow and track ssh brute force
pass in on $extif proto tcp from any to any port ssh \
flags S/SA keep state \
(max-src-conn 5, max-src-conn-rate 5/50, \
overload <bruteforce> flush global)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment