<div dir="ltr">Out of curiosity, did ya inquire with the ISC folks about adding such "rate limiting" functionality to Kea? It's under fairly active development and they seem responsive to user community.<div> </div><div>--Matt</div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 25, 2019 at 4:18 AM Pascal Gloor <<a href="mailto:pascal.gloor@spale.com">pascal.gloor@spale.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Community, NOTE: I hope this post is appropriate in this mailinglist, please let me know if it isn’t. I don’t know about you, but as an ISP we’ve always faced the problem of crazy DHCP clients (v4 and v6) flooding our servers. While at my employer we have a proprietary DHCP server with anti-flood mechanisms it might not the case for everyone. This is why I wrote DHCP Protect. DHCP Protect works with the userspace API of Netfilter (iptables/ip6tables) and will treat each DHCP(v4/v6) packet and decide if it should be forwarded or not. Don’t worry, iptables can be configured in a way that if the program is not working, it will ACCEPT the packets by default. There are no packages available, but don’t be scared, it’s really simple to install and it will do all the systemd stuff for you! After make install it will already be running (you can also make uninstall which will delete everything and remove it from systemd). git clone <a href="https://git.home.spale.com/dhcp_protect.git" rel="noreferrer" target="_blank">https://git.home.spale.com/dhcp_protect.git</a> cd dhcp_protect sudo apt-get install build-essential uthash-dev libnetfilter-queue-dev make all sudo make install That’s it. And then you need the iptables/ip6tables rule: iptables -A INPUT -p udp -m udp --dport 67 -j NFQUEUE --queue-num 67 --queue-bypass ip6tables -A INPUT -p udp -m udp --dport 547 -j NFQUEUE --queue-num 67 --queue-bypass (SAME queue number! the program can treat v4/v6 at the same time) It doesn’t need to be on the DHCP server itself, it can also be run on the path, in that case replace INPUT by FORWARD. The program will log to syslog when it blacklists. I’ve tested this with 10kpps and the CPU load of the program was about 4-6% on one core (AMD Ryzen 7 2700X). There’s also a flooding perl client in the repository to test the performance. It can do pseudo DHCPv4/DHCPv6, but since it’s pseudo, don’t use the <a href="http://perftest.pl" rel="noreferrer" target="_blank">perftest.pl</a> against a real DHCP server. More information in the README -> <a href="https://git.home.spale.com/public/dhcp_protect" rel="noreferrer" target="_blank">https://git.home.spale.com/public/dhcp_protect</a> I’d be glad on feedback! It is useful? what additional features would you like to see? Thanks for reading Pascal _______________________________________________ opensource-wg mailing list <a href="mailto:opensource-wg@ripe.net" target="_blank">opensource-wg@ripe.net</a> <a href="https://lists.ripe.net/mailman/listinfo/opensource-wg" rel="noreferrer" target="_blank">https://lists.ripe.net/mailman/listinfo/opensource-wg</a> </blockquote></div>