For example, the following rules will protect the webserver against hosts
     making more than 100 connections in 10 seconds.  Any host which connects
     faster than this rate will have its address added to the <bad_hosts>
     table and have all states originating from it flushed.  Any new packets
     arriving from this host will be dropped unconditionally by the block
     rule.

           block quick from <bad_hosts>
           pass in on $ext_if proto tcp to $webserver port www flags S/SA keep state \
                   (max-src-conn-rate 100/10, overload <bad_hosts> flush global)