Using rules to slow down traffic

[JeGr]

Hi anyone!

Perhaps some of you guys have already done what I'm thinking about. We have a CARP cluster of pfSense (rocks!) in our datacenter in front of a bunch of loadbalanced webservers. Besides that they should handle their daily work quite well I had two incidents this year of one of our customers (the one with the heaviest traffic site on our servers) misconfiguring some SAP client. This resulting in some sort of rampage of said client on their own web service with hundreds of connections. We finally blocked it out with a rule in the webserver by tracking it by its user agent. But that lead to the question, if we can simply modify our "pass" rule to that webservice with some advanced settings.

Is there somebody out there who has a rule running, that limits traffic (eg. states, connects per IP, …) to some good value? I tried setting up a rule but ended with a situation, that after 20 connects to that server pfSense simply dropped further connects and it didn't seem to get better after a few minutes (i tried setting xy connects per nm seconds).

I would be thankful for some real-life-action input.

Greets
Jens