Hau dir folgende sachen in dein System :
[Only registered and activated users can see links. Click Here To Register...]
Benutz folgende PF.rules:
PHP Code:
### INTERFACES ###
if = "{ em0 }"
#Intra
table <intranet> { 127.0.0.1 }
pass in quick from <intranet> to any keep state
#Network
table <network> persist
block quick from <network>
pass in on $if proto tcp from any to any
keep state (max-src-conn 100, max-src-conn-rate 15/1,
overload <network> flush global)
Schreib folgendes in deine sysctl.conf (befindet sich in der etc):
PHP Code:
vfs.vmiodirenable=1
kern.ipc.maxsockbuf=16777216
kern.ipc.somaxconn=8192
net.inet.tcp.rfc1323=1
net.inet.tcp.sack.enable=1
net.inet.tcp.sendbuf_auto=1
net.inet.tcp.recvbuf_auto=0
net.inet.tcp.sendbuf_max=16777216
net.inet.tcp.recvbuf_max=16777216
net.inet.tcp.sendbuf_inc=16384
net.inet.tcp.recvbuf_inc=524288
net.inet.tcp.sendspace=65536
net.inet.tcp.recvspace=65536
net.inet.udp.recvspace=65536
net.inet.udp.maxdgram=57344
net.local.stream.recvspace=65536
net.local.stream.sendspace=65536
kern.maxfiles=204800
kern.maxfilesperproc=200000
kern.maxvnodes=200000
# Security networking
# Limit ICMP
net.inet.icmp.icmplim=50
net.inet.icmp.maskrepl=0
net.inet.icmp.drop_redirect=1
net.inet.icmp.bmcastecho=0
net.inet.tcp.icmp_may_rst=0
# Drop synfin packets
net.inet.tcp.drop_synfin=1
# a single pass through the firewall
# net.inet.ip.fw.one_pass=1
# adds more queue buckets for ipfw dummynet
# net.inet.ip.dummynet.hash_size=2048
# increase the size of network mbufs to allocate
#kern.ipc.nmbclusters=262144
# If above used add the following to /boot/loader.conf - reb
# kern.ipc.nmbclusers="65536"
# This is for dos protection
net.inet.tcp.msl=7500
# Turn off stealth IP networking
#net.inet.ip.stealth=0
# Try to protect against scans
net.inet.tcp.blackhole=2
net.inet.udp.blackhole=1
# Try to stop some syn flood attacks, and route cache degreg
net.inet.ip.rtexpire=2
net.inet.ip.rtminexpire=2
net.inet.ip.rtmaxcache=256
# Drop evil sourcerouted packets
net.inet.ip.accept_sourceroute=0
net.inet.ip.sourceroute=0
# Turn it on when you have two interfaces on same switch
# net.link.ether.inet.log_arp_wrong_iface=0
net.inet.tcp.log_in_vain=1
net.inet.udp.log_in_vain=1
kern.ipc.nmbclusters=262144
net.inet.tcp.delayed_ack=0
net.inet.tcp.inflight.enable=0
net.inet.ip.ttl=128
net.inet.tcp.maxtcptw=200000
net.inet.tcp.fast_finwait2_recycle=1
net.inet.ip.intr_queue_maxlen=4096
vfs.read_max=32
net.inet.tcp.ecn.enable=1
net.inet.tcp.hostcache.expire=1
security.bsd.see_other_gids=0
security.bsd.see_other_uids=0
security.bsd.unprivileged_read_msgbuf=0
kern.ipc.shmmax=134217728
kern.ipc.shmall=32768
kern.ipc.semmap=256
Somit sollte dein Root erstmal standhalten :D
