0

My firewall is hitting a problem related to max states per rule.

#  pfctl -vvsi
Status: Enabled for 0 days 13:05:38           Debug: Urgent

Hostid:   0x6556c6a9
Checksum: 0xe80368af9b3c0a876218cd2af59fbed5

State Table                          Total             Rate
  current entries                     7614
  searches                       323053106         6853.3/s
  inserts                          6650716          141.1/s
  removals                         6643102          140.9/s
Source Tracking Table
  current entries                        0
  searches                               0            0.0/s
  inserts                                0            0.0/s
  removals                               0            0.0/s
Counters
  match                           31988315          678.6/s
  bad-offset                             0            0.0/s
  fragment                               0            0.0/s
  short                                  0            0.0/s
  normalize                              0            0.0/s
  memory                                 0            0.0/s
  bad-timestamp                          0            0.0/s
  congestion                             0            0.0/s
  ip-option                             12            0.0/s
  proto-cksum                            0            0.0/s
  state-mismatch                      4702            0.1/s
  state-insert                       45381            1.0/s
  state-limit                        13837            0.3/s
  src-limit                              0            0.0/s
  synproxy                               0            0.0/s
Limit Counters
  max states per rule                13837            0.3/s
  max-src-states                         0            0.0/s
  max-src-nodes                          0            0.0/s
  max-src-conn                           0            0.0/s
  max-src-conn-rate                      0            0.0/s
  overload table insertion               0            0.0/s
  overload flush states                  0            0.0/s

As we can see above we are hitting state-limits due to max states per rule

My maxes are quite large:

# pfctl -sm
states        hard limit   550000
src-nodes     hard limit    50000
frags         hard limit     5000
tables        hard limit     5000
table-entries hard limit   400000

But how I can increase the max states per rule?

1 Answer 1

1

Have you tried this?

PF.CONF(5)                       File Formats Manual                       PF.CONF(5)

…
STATEFUL TRACKING OPTIONS
     A number of options related to stateful tracking can be applied on a per-rule
     basis.  keep state, modulate state and synproxy state support these options, and
     keep state must be specified explicitly to apply options to a rule.

     max ⟨number⟩
           Limits the number of concurrent states the rule may create.  When this
           limit is reached, further packets that would create state will not match
           this rule until existing states time out.
…
2
  • That's a good point. I forgot about maxes per rule settings. Wandering if there are known defaults pf applies when max is not specified in the rule?
    – Luman75
    Nov 19, 2022 at 9:23
  • Guess gotta check the sources…
    – poige
    Nov 19, 2022 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.