Конфиг
Код: Выделить всё
### Описание интерфейсов ###
int_if="lan"
ext_if="tun0"
vpn_if="tun1"
lannet="192.168.1.0/24"
int_ip="192.168.1.1"
ext_ip="1.2.3.4"
vpn_ip="10.10.100.1"
pbx="192.168.1.11"
www="{ 80,443 }"
mail="{ 465,587,993,995,143 }"
rdp="{ 730 }"
torrent="{ 51413,49152:65535,5650:5670 }"
ssh="{ 1981,1985,1986 }"
vpn="{ 1983, 1423 }"
ftp="{ 20,21,30000:65000 }"
voip="{ 4000:4010,4050:4090,5060:5065,5160:5165,8000:8002,9000:65534 }"
udp_services="{ 53,123 }"
icmp_types="{echoreq, unreach}"
### PF_tables ###
table <white_list> persist { 1.2.3.4 }
table <full_dos> persist file "/etc/pftables/full_dos"
table <ca.zone> persist file "/etc/pftables/ca.zone"
table <cn.zone> persist file "/etc/pftables/cn.zone"
table <de.zone> persist file "/etc/pftables/de.zone"
table <fr.zone> persist file "/etc/pftables/fr.zone"
table <ua.zone> persist file "/etc/pftables/ua.zone"
table <ip.bloc> persist file "/etc/pftables/ip.bloc"
#table <ddos> persist file "/etc/pftables/ddos"
#table <ssh> persist file "/etc/pftables/ssh"
### CONTROL PF ###
#set block-policy return ## сбрасываем соединение вежливо
set timeout { frag 10, tcp.established 3600 } # Изменяем время для состояния установленного tcp соединения, которое по-умолчанию чересчур большое (24часа).
set block-policy drop ## сбрасываем соединение грубо
set skip on lo0 ## полностью пропускаем проверку на петле
set skip on $int_if ## полностью пропускаем проверку на интерфейсе
set skip on $vpn_if
set loginterface $ext_if
set optimization normal
scrub in all ## нормализуем все входящие пакеты на всех интерфейсах
scrub on $ext_if all reassemble tcp
### NAT ###
#nat on $ext_if inet from $lannet to any -> ($ext_if)
nat on $ext_if inet from $int_ip to any -> ($ext_if)
nat on $ext_if inet from <full_dos> to any -> ($ext_if)
nat on $ext_if inet proto tcp from $lannet to any port $www -> ($ext_if)
nat on $ext_if inet proto tcp from $lannet to any port $mail -> ($ext_if)
nat on $ext_if inet proto udp from $lannet to any port $udp_services -> ($ext_if)
nat log on $ext_if inet proto icmp from $lannet to any -> ($ext_if)
### filters ###
antispoof log quick for { lo0, $int_if, $ext_if }
### Блочим всех кто находится в таблице ###
block in log all
block out log all
block in quick on $ext_if from <ip.bloc> to ($ext_if)
block in quick on $ext_if from <ca.zone> to ($ext_if)
block in quick on $ext_if from <cn.zone> to ($ext_if)
block in quick on $ext_if from <de.zone> to ($ext_if)
block in quick on $ext_if from <fr.zone> to ($ext_if)
block in quick on $ext_if from <ua.zone> to ($ext_if)
block in quick on $ext_if from <us.zone> to ($ext_if)
block drop in log quick on $ext_if from <ddos> to any
block drop in log quick on $ext_if from <ssh> to any
pass out quick on $ext_if from ($ext_if) to any
pass out quick on $vpn_if from ($vpn_if) to any
pass quick on lo0 all ## разрешаем петлю
pass quick on $ext_if from <white_list> to ($ext_if) keep state
# Разрешаем открытые порты на внешнем интерфейсе
pass in on $ext_if proto tcp from any to ($ext_if) port $www synproxy state ## чистим траф www от SYN flood
pass in on $ext_if proto tcp to ($ext_if) port $www flags S/SA keep state \(max-src-conn 60, max-src-conn-rate 10/2, overload <ddos> flush) ## www режим тех кто превысил лимиты и ложим в таблицу
pass in on $ext_if proto tcp to ($ext_if) port $ssh flags S/SA keep state \(max-src-conn 5, max-src-conn-rate 10/5, overload <ssh> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $rdp flags S/SA keep state \(max-src-conn 1, max-src-conn-rate 5/20, overload <ddos> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $ftp flags S/SA keep state \(max-src-conn 1, max-src-conn-rate 5/20, overload <ddos> flush global)
pass in on $ext_if proto udp to ($ext_if) port $vpn keep state \(max-src-conn 1, max-src-conn-rate 5/20, overload <ddos> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $mail flags S/SA keep state \(max-src-conn 50, max-src-conn-rate 8/60, overload <ddos> flush global)
pass in on $ext_if proto tcp to ($ext_if) port $torrent keep state \(max-src-conn 50, max-src-conn-rate 10/60, overload <ddos> flush global)
pass in quick on $ext_if inet proto {tcp, udp, icmp} all keep state
pass log inet proto icmp all icmp-type $icmp_types
Вопрос. Подскажите есть ли в данном примере ошибки так как я подозреваю что некорректно отрабатываются правила "pass" так как периодически падает MySQL из за ddos атак а именно не работает правило "pass in on $ext_if proto tcp to ($ext_if) port $www flags S/SA keep state \(max-src-conn 60, max-src-conn-rate 10/2, overload <ddos> flush)" и в логах апача появляется следующие "163.172.141.220 - - [18/Nov/2016:21:00:39 +0600] "POST /xmlrpc.php HTTP/1.0" 200 370"