diff --git a/HowtoOpenBSD/PacketFilter.md b/HowtoOpenBSD/PacketFilter.md index b852d262..88b1bf7a 100644 --- a/HowtoOpenBSD/PacketFilter.md +++ b/HowtoOpenBSD/PacketFilter.md @@ -87,3 +87,106 @@ Il faut a priori effacer la table avec ~~~ # pfctl -t -T kill ~~~ + +### Valeurs des timeout + +D'après la man : + +~~~ + set optimization environment + Optimize state timeouts for one of the following network + environments: + + aggressive + Aggressively expire connections. This can greatly reduce + the memory usage of the firewall at the cost of dropping + idle connections early. + conservative + Extremely conservative settings. Avoid dropping + legitimate connections at the expense of greater memory + utilization (possibly much greater on a busy network) and + slightly increased processor utilization. + high-latency + A high-latency environment (such as a satellite + connection). + normal A normal network environment. Suitable for almost all + networks. + satellite + Alias for high-latency. + +~~~ + +Aggressive + +~~~ +tcp.first 120s +tcp.opening 30s +tcp.established 86400s +tcp.closing 900s +tcp.finwait 45s +tcp.closed 90s +tcp.tsdiff 30s +udp.first 60s +udp.single 30s +udp.multiple 60s +icmp.first 20s +icmp.error 10s +other.first 60s +other.single 30s +other.multiple 60s +frag 60s +interval 10s +adaptive.start 6000 states +adaptive.end 12000 states +src.track 0s +~~~ +Normal + +~~~ +tcp.first 30s +tcp.opening 5s +tcp.established 18000s +tcp.closing 60s +tcp.finwait 30s +tcp.closed 30s +tcp.tsdiff 10s +udp.first 60s +udp.single 30s +udp.multiple 60s +icmp.first 20s +icmp.error 10s +other.first 60s +other.single 30s +other.multiple 60s +frag 60s +interval 10s +adaptive.start 6000 states +adaptive.end 12000 states +src.track 0s +~~~ + +Satellite + +~~~ +tcp.first 180s +tcp.opening 35s +tcp.established 86400s +tcp.closing 905s +tcp.finwait 50s +tcp.closed 95s +tcp.tsdiff 60s +udp.first 60s +udp.single 30s +udp.multiple 60s +icmp.first 20s +icmp.error 10s +other.first 60s +other.single 30s +other.multiple 60s +frag 60s +interval 10s +adaptive.start 6000 states +adaptive.end 12000 states +src.track 0s + +~~~