Vladimir Grebenshchikov e2eec67a33 Add PF synlimit backend ...

Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.

2026-07-20 09:43:46 +02:00

..

CONFIG_PARAMS.de.md

Create CONFIG_PARAMS.de.md

2026-07-09 22:42:07 +03:00

CONFIG_PARAMS.en.md

Add PF synlimit backend

2026-07-20 09:43:46 +02:00

CONFIG_PARAMS.ru.md

Update CONFIG_PARAMS.ru.md

2026-07-08 20:52:26 +03:00