PHREL v2.1.0 (07/05/26) - http://www.digitalgenesis.com

Additional information and install help can be found on the PHREL website:

  http://www.digitalgenesis.com/software/phrel/

Package Install:

  Pre-built packages for several Linux distributions are available from the
  PHREL downloads page:

    http://www.digitalgenesis.com/software/phrel/packages/

  Debian / Ubuntu (.deb):

    Browse to the directory matching your release (debian12, debian13,
    ubuntu22, ubuntu24, or ubuntu26) and download phrel_2.1.0_amd64.deb.
    Install as root:

      dpkg -i phrel_2.1.0_amd64.deb

  RHEL / Amazon Linux (.rpm):

    Browse to the directory matching your release (rhel8, rhel9, or
    amazonlinux2023) and download phrel-2.1.0-1.*.x86_64.rpm. Install as root:

      rpm -Uvh phrel-2.1.0-1.*.x86_64.rpm

  After installing a package, edit /etc/phrel/phreld.conf as needed and start
  the service:

      systemctl enable --now phreld

Source Install:

  0. Download and extract the source archive from the packages directory:

       tar xzf phrel-2.1.0.tar.gz
       cd phrel-2.1.0

  1. Run './configure' in the phrel directory (you may need extra flags).

     ./configure --help

     Redis cross-instance sync is enabled by default when libhiredis is
     installed. Use --disable-redis to build without Redis support.

  2. Run 'make', then 'make install' as root.

     make
     su -c 'make install'

  3. Optionally, edit the default configuration installed to
     /etc/phrel/phreld.conf. When phreld is started with no command-line
     options, this file is read automatically.

  4. Start phreld.

     systemctl enable --now phreld

     -or-

     /usr/sbin/phreld

Configuration:

  PHREL v2.0 and later uses a brace-block configuration file. See phreld.conf(5)
  for the full schema. The default file installed to /etc/phrel/phreld.conf
  rate limits ICMP to 10 packets per second per host.

  Command-line options override values from the configuration file. When other
  command-line options or a BPF expression are given, a configuration file is
  not required unless -C is specified.

Cross-Instance Sync (Optional):

  PHREL can synchronize per-host statistics across instances using Redis.
  Configure a redis { } block in phreld.conf. See phreld.conf(5) for server,
  instance-file, algo, and threshold options. If Redis is unreachable at
  startup, phreld logs a warning and continues as a single-instance rate
  limiter.

Examples:

  1) Protect your nameserver (DNS).

     This example uses phreld to listen on UDP port 53 (DNS) for hosts that
     exceed the threshold of 50 PPS and 150 PPS. Hosts exceeding 50 PPS are
     rate limited to 25 PPS. Hosts exceeding 150 PPS are blocked (rate of 0).

     # /usr/sbin/phreld -P udp -p 53 -T 50:25 -T 150:0

  2) Protect SSH from brute force login attempts.

     This example uses phreld to listen on TCP port 22 (SSH) for hosts that
     attempt to connect more than 5 times in 30 seconds (interval). Hosts that
     exceed this threshold are blocked for 1800 seconds (decay).

     # /usr/sbin/phreld -A sum -i 30 -D 1800 -T 5:0 'port 22 and tcp[13] & tcp-syn != 0'

Requirements:

  PHREL v2.x requires nftables (nf_tables kernel subsystem and libnftables).
  There is no iptables fallback. Supported platforms include RHEL 8+, Ubuntu
  22.04+, Debian 12+, and other distributions with nf_tables as the default
  firewall backend.

Fini