Define drop based on payload length

[kradalby]

Hi

I have a quick question. I have a lot of css server which i currently have ddos problems with, and i found out that i can at least block one of the methods they are using by defining a drop if the package is to big.

Most of the information i have found have been on adding the rule to iptables on the server, but since the server is behind my pfsense box and is depending on NAT, isnt it more logical for me to do this in the PFsense box?

And the rule all the other game server hosts uses is this:
iptables -A INPUT -p udp –dport 27015 -m length --length 28 -j DROP
As i understand i takes incomming UDP traffic and drops it if the lenght is equal or over 28?, but i dont really know what 28 is, and i dont know how to do this in pfsense if that is the right place to do it.

Thanks for any help in advance.

Kristoffer