I have the following settings in my pf.conf to dissuade abusive clients (I get a few a day that are obviously just scraping content indiscriminately and slow everything down):
pass in on $ext_if proto tcp to { $loadbalancer1_int } port $web_ports flags S/SA keep state (max-src-conn 80, max-src-conn-rate 200/5, overload <web_flood> flush)
pass in on $ext_if proto tcp to { $loadbalancer2_int } port $web_ports flags S/SA keep state (max-src-conn 80, max-src-conn-rate 200/5, overload <web_flood> flush)
Unfortunately some of my customers are getting themselves blocked. I don't know what these customers are doing to trigger such network IO. I keep upping the values and they keep getting themselves blocked. Aren't these values (80 connections & 200 connections within 5 seconds) well within what would generally be considered "abusive"?