Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having an issue where someone is using a VPN / proxy to hammer my server. They will pick on random URL from my website and perform ~20 requests per second to it.

Once I ban the IP address, a few minutes later a new IP address takes it's spot and hammers a different URL.

I'm trying to solve this issue with the following rule set, but it's now working. Could someone let me know what I'm doing wrong?

table <blacklist> persist
block quick from <blacklist>
pass in log on $EXT_IF proto tcp from any to any port 80 \
     flags S/SA keep state \
     (max-src-conn-rate 10/5, overload <blacklist> flush global)
share|improve this question
Why the down vote? – Dave Mar 29 '14 at 19:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.