Bloquear Ataques por DDoS

pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""

block in all
pass in quick on lo0
pass out quick on lo0
table persist file "/var/db/lalista(lo llamamos como queramos)"
block quick from
pass in quick on sis0 proto tcp from any to any port 22 keep state
pass in quick on sis0 proto tcp from any to any port 80 keep state
pass in quick on sis0 proto tcp from any to any port 3690 keep state
pass out all keep state

#!/usr/bin/perl

use strict;

my @assholes = ();

open (IN, "/var/log/auth.log");
while () {
if ($_ =~ /Invalid user.*from ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/) {
push(@assholes, $1);
}
if ($_ =~ /Did not receive identification string from ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/) {
push(@assholes, $1);
}
}
close (IN);

@assholes = sort {lc($a) cmp lc($b)} @assholes;

my @allowedIPs = ();
open (IN, "/var/db/allowed-ips");
while () {
if ($_ =~ /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {
push(@allowedIPs, $_);
}
}
close (IN);

chop(@allowedIPs);

my $tmp = "";
foreach my $asshole (@assholes) {
if ($asshole eq $tmp) {
$asshole = "";
} else {
if ($asshole =~ /127\.0\.0\.1/) {
$asshole = "";
}
if ($asshole =~ /192\.168\.[0-9]+\.[0-9]+/) {
$asshole = "";
}
foreach my $allowedIP (@allowedIPs) {
if ($asshole =~ /$allowedIP/) {
$asshole = "";
}
}
$tmp = $asshole;
}
}

@assholes = sort {lc($b) cmp lc($a)} @assholes;

my $popCount = 0;
foreach my $asshole (reverse @assholes) {
if ($asshole eq "") {
$popCount++;
}
}

for (my $i = 0; $i < $popCount; $i++) {
pop (@assholes);
}

my $list = "";
foreach my $asshole (@assholes) {
$list = $list . $asshole . " ";
}

exec "/sbin/pfctl -t bloqueo -T add $list";