##### To Remove A IP From PF ##################
pfctl -t bruteforce -T delete yourip
SSH Brute Force Attack Auto Deny with PF
1.Modify /etc/rc.conf and add these lines. This will enable PF to start
up when the server does and loads the rules file.
vi /etc/rc.conf
Insert these lines:
#enable PF
pf_enable="YES"
pflog_enable="YES"
pf_rules="/etc/pf.conf"
vi /etc/pf.conf
Insert these lines:
ext_if = "em0"
#SSH Deny Block. 15 max connection, 5 connection attemptes every 30 seconds.
table <bruteforce> persist
block quick from <bruteforce>
pass in on $ext_if inet proto tcp from any to $ext_if port 22 \
flags S/SA keep state \
(max-src-conn 15, max-src-conn-rate 5/30, \
overload <bruteforce> flush global)
3. Install expiretables
cd /usr/ports/security/expiretables && make install clean
4. Edit the crontab to flush ssh deny table
vi /etc/crontab
Insert this line:
#Clear SSH Deny Table
1 3 * * * /usr/local/sbin/expiretable -t 3600 bruteforce
5. Manually view table entries:
pfctl -t bruteforce -T show
pfctl -s all
pfctl -vs rules
To manually clear table :
/usr/local/sbin/expiretable -t 3600 bruteforce