For example, the following rules will protect the webserver against hosts
making more than 100 connections in 10 seconds. Any host which connects
faster than this rate will have its address added to the <bad_hosts>
table and have all states originating from it flushed. Any new packets
arriving from this host will be dropped unconditionally by the block
rule.
block quick from <bad_hosts>
pass in on $ext_if proto tcp to $webserver port www flags S/SA keep state \
(max-src-conn-rate 100/10, overload <bad_hosts> flush global)