Can someone help me convert iptable rules to freebsd pf rules. I have already tried fwbuilder, but without success. It seems that some rules can not be ported, and other seem to be logically different. I want to port following:
-A INPUT -p icmp -m limit --limit 5/sec -j ACCEPT
-A INPUT -p icmp -f -j DROP
-A INPUT -p icmp -j DROP
Problem with pf is that it seems there is no flag for rate of received packages. There is only flag for connection rate. Another problem is that in pf I can't drop fragmented packets.
-A INPUT -m pkttype --pkt-type broadcast -j DROP
-A INPUT -m addrtype --dst-type BROADCAST -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i ETH3 -p tcp -m tcp --dport 2576 -m limit --limit 50/sec --limit-burst 100 -j ACCEPT
-A INPUT -i ETH3 -p tcp -m tcp --dport 2576 -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
-A INPUT -i ETH3 -p tcp -m tcp --dport 2576 -m recent --update --seconds 5 --hitcount 200 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP
Problem with pf is that I can't match MAC broadcast messsages. Also on pf is possible to detect host that tries to connect with high connection rate and to put it table with banned host. The problem is that the host can't be removed from table. So if host is recognized as bad host, it can't ever be trusted again(and messages from that host will be dropped). Another issue is that pf messages doesn't have states, e.g. RELATED and ESTABLISHED.