@Gertjan:
Not a good idea.
These request will trigger the portal login page, which will not be shown to some one, as I understood it concerns background polling of cell phones etc.
But: finally, the user would open up his facebook account ….. and unable to login the portal interface because it blocked that user. The guy will look for you to unblock him (hummm, so you can tell him he is punished because his device is hammering your network ;)).
I don't know of the 'log' daemon of pfSense supports discarding - if it does, think about throwing away multiple "mod_evasive.c" lines.
Good point. Clients needs to pay first before I 'unblock' them :-) (I implemented a online pay system above the captive portal)
When I look at the source of 'mod_evasive.c' the max_connections is actually a config property (can not see yet where it set) and if I like I can remove the log rule.
if (conns_by_ip > p->conf.max_conns) {
log_error_write(srv, __FILE__, __LINE__, "ss",
inet_ntop_cache_get_ip(srv, &(con->dst_addr)),
"turned away. Too many connections.");
con->http_status = 403;
con->mode = DIRECT;
return HANDLER_FINISHED;
}
Thanks!
