| @@ -3,4 +3,50 @@ | |||
| A userspace application that filters DHCP floods to protect a DHCP server. It uses the Netfilter userspace packet queuing API. | |||
| # Dependencies | |||
| build-essential uthash-dev libnetfilter-queue-dev | |||
| ``` | |||
| apt-get install build-essential uthash-dev libnetfilter-queue-dev | |||
| ``` | |||
| # Configuration | |||
| ``` | |||
| # max_pkt_per_interval | |||
| # maximum number of packets authorised per time interval. | |||
| max_pkt_per_interval=30 | |||
| # interval | |||
| # measurement time interval in seconds. | |||
| interval=30 | |||
| # debug | |||
| # enable debugging, warning, very verbose | |||
| debug=1 | |||
| # blacklist_time | |||
| # number of seconds this client will be ignored once | |||
| # it exceeded the max_pkt_per_interval per interval | |||
| blacklist_time=55 | |||
| # queue number | |||
| # refers to the queue-num of iptables. | |||
| # -A FORWARD -p udp -m udp --dport 67 -j NFQUEUE --queue-num 67 --queue-bypass | |||
| queue=67 | |||
| # dryrun | |||
| # if dryrun is set to 1 it will accept all packets no matter what. | |||
| # this can be used for testing, syslog will still display the blacklisting | |||
| # actions. | |||
| # Set to 0 for production. | |||
| dryrun=1 | |||
| ``` | |||
| # Run | |||
| ``` | |||
| root@router:~/dhcp_protect# ./dhcp_protect ./dhcp_protect.conf | |||
| Loading configuration ./dhcp_protect.conf | |||
| Configuration: | |||
| dryrun = Yes | |||
| debug = Yes | |||
| interval = 30s | |||
| max_pkt_per_interval = 30 | |||
| blacklist_time = 55s | |||
| queue = 67 | |||
| ``` | |||