diff --git a/README.md b/README.md index ce72150..15c6708 100644 --- a/README.md +++ b/README.md @@ -286,10 +286,10 @@ A custom `[section]` has the following options. We're calling them locals most o ``` UFS generates rules: ``` - target prot opt in out source destination - DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 143,993,110,995,25,465,587 recent: UPDATE seconds: 60 hit_count: 120 name: anyone-may-access-mail-services side: source mask: 255.255.255.255 - tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 143,993,110,995,25,465,587 recent: SET name: anyone-may-access-mail-services side: source mask: 255.255.255.255 - ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 143,993,110,995,25,465,587 /* anyone-may-access-mail-services */ + target + DROP ... multiport dports 143,993,110,995,25,465,587 recent: UPDATE seconds: 60 hit_count: 120 ... + ... multiport dports 143,993,110,995,25,465,587 recent: SET ... + ACCEPT ... state NEW multiport dports 143,993,110,995,25,465,587 ... ``` Where the first `DROP` target will drop packets that have exceeded their hit count; the second `recent: SET` simply marks all matching packets to be added into the hitcount bucket and the third on is the actual `ACCEPT` rule permitting access **_if_** a source's hitcount permits it.