Tuesday, September 06, 2022

Recommended options to block bruteforce requests on udp

Hi all,

I have a very important question with massive requests to udp ports.
Until now I had the following options configured:

(max-src-conn 30, max-src-conn-rate 10/1, overload <bruteforce> flush
global)

I have several services published through udp, most importantly
WireGuard, but I'm not sure about activating those options. For exmaple,
using the following options for tcp:

(max-src-conn 10, max-src-conn-rate 15/5, overload <bruteforce> flush
global)

several IPs goes to bruteforce table ... but for udp, nothing .... and t
it seems strange to me.

Is my config ok or do you see some gotchas?
--
Best regards,
C. L. Martinez

No comments:

Post a Comment