#-----------------------------------------------------------------------------#
#    This file contains sample connection monitoring rules.                   #
#                                                                             #
#    To activate the rules, simply move them to firerule.cnf and update the   #
#    attributes to match your setup.                                          #
#                                                                             #
#    DISCLAIMER: Not all samples have been tested by F/X Communications.      #
#-----------------------------------------------------------------------------#


#-----------------------------------------------------------------------------#
#                                                                             #
#    This rule will blacklist IP numbers responsible for 10 or more           #
#    concurrent TCP connections.                                              #
#                                                                             #
#    NOTE: Use of the 'Connections' attribute introduces a substantial hit    #
#    on CPU load.                                                             #
#                                                                             #
#-----------------------------------------------------------------------------#

Connection-Limit        Comment = "Blacklist on 10 concurrent connections",
                        Rule-Action = Blacklist,
                        Connections = ">=10",
                        Direction = Incoming,
                        Log-Control = Enabled,
                        Log-Message = "Blacklisted (Reason: more than 9 connections)",
                        Log-Severity = Medium,
                        Security-Level = 8,



