HAPROXY anti DDOS - add stick tables to frontend & track HTTP request rate

nzkiwi68

HAPROXY has a lot of very powerful anti DOS and DDOS features which currently aren't implemented by pfSense.

To do it properly, we need to be able to set stick tables on the frontend, tracking HTTP request rate and write ACL's to use it.

These references show the config required;
Application-Layer DDoS Attack Protection with HAProxy
HAProxy Rate Limiting: Four Examples

frontend website
    bind :80
    stick-table  type ip  size 100k  expire 30s  store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 20 }
    default_backend servers

viktor_g

You can create a feature request: https://docs.netgate.com/pfsense/en/latest/development/requesting-new-pfsense-features.html

xwx

Did you do it manually does it work? And if yes you modified config file or done it from UI ?
Thanks.