Re: FreeBSD firewall block syn flood attack

From: jeremie le-hen (le-hen_j_at_epita.fr)
Date: 05/20/03

  • Next message: Greg Panula: "Re: FreeBSD firewall block syn flood attack" 
    Date: Tue, 20 May 2003 11:58:00 +0200
To: freebsd-security@freebsd.org

    > I current have a FreeBSD 4.8 bridge firewall that sits between 7 servers and
    > the internet. The servers are being attacked with syn floods and go down
    > multiple times a day.
    >
    > The 7 servers belong to a client, who runs redhat.
    >
    > I am trying to find a way to do some kind of syn flood protection inside the
    > firewall.

    I don't think a firewall can achieve this, even if it has some matching
    options like the "limit" match in Netfilter, which permits to specify a
    maximum number of times a rule can match in a given period, since if the
    SYN-flood is cleverly done (ie. randomly spoofed), other valid connections
    attempts will be also limited.

    IMHO, the only efficient way to achieve this is to use syncookies on the
    servers themselves. You should tell your client to set CONFIG_SYNCOOKIES
    in their Linux kernel (in fact, in RedHat, it should already be the case,
    at least if the kernel is recent enough), and then to turn it on with:
            echo 1 >/proc/sys/net/ipv4/tcp_syncookies

    Here is a description of this sysctl:
    tcp_syncookies - BOOLEAN
            Only valid when the kernel was compiled with CONFIG_SYNCOOKIES
            Send out syncookies when the syn backlog queue of a socket
            overflows. This is to prevent against the common 'syn flood attack'
            Default: FALSE

            Note, that syncookies is fallback facility.
            It MUST NOT be used to help highly loaded servers to stand
            against legal connection rate. If you see synflood warnings
            in your logs, but investigation shows that they occur
            because of overload with legal connections, you should tune
            another parameters until this warning disappear.
            See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.

            syncookies seriously violate TCP protocol, do not allow
            to use TCP extensions, can result in serious degradation
            of some services (f.e. SMTP relaying), visible not by you,
            but your clients and relays, contacting you. While you see
            synflood warnings in logs not being really flooded, your server
            is seriously misconfigured.

    Note that in fact, this might be achieved on your firewall (FreeBSD also
    supports syncookies), but this would imply TCP SYN to be received by the
    firewall itself, which in turn would forward the TCP connection to the
    appropriate server once the connection would be fully established.
    (I think a simple TCP tunnel with a NAT redirection to localhost should
    work.)

    Regards, 

    -- 
Jeremie aka TtZ/TataZ
jeremie.le-hen@epita.fr
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Greg Panula: "Re: FreeBSD firewall block syn flood attack"

    Relevant Pages

    • Re: Firewall Hardware and a bit of a Rant
      ... I need advice on which hardware firewall to purchase for a client with 20 users. ... I'm fairly new to SBS and have installed 3 servers. ... Watchguard seem to think they are Cisco and don't have to provide support to smaller IT guys because they are so powerful etc.. ... If my client didn't need web filtering, I'd bang a PIX in and use the Cisco VPN Client for remote access with local database XAuth to provide double authentication. ...
      (microsoft.public.windows.server.sbs)
    • Re: Firewall Hardware and a bit of a Rant
      ... I need advice on which hardware firewall to purchase for a client ... I'm fairly new to SBS and have installed 3 servers. ... I've read Leythos's advice on Watchguard Firewalls ... can provide Firewall, Content Filtering and be a VPN server/End Point ...
      (microsoft.public.windows.server.sbs)
    • Re: Firewall Hardware and a bit of a Rant
      ... I need advice on which hardware firewall to purchase for a client with 20 ... I'm fairly new to SBS and have installed 3 servers. ... With the X550e you can install it on your own and have it working in ...
      (microsoft.public.windows.server.sbs)
    • Re: [fw-wiz] SYN flood protection strategies (Was: Post connection SYN)
      ... >> OR you set up the firewall to answer SYNs on behalf of the server ... I've moved the problem from servers with perhaps as low as 5 embryonic ... SYN sockets per port, that block for a full minute when the list is ... there are TCP stacks that handle SYN floods much better than ...
      (Firewall-Wizards)
    • RE: Sizing a Firewall for a client
      ... Application firewalls on the desktop and servers are nice ... Zone Alarm and Zone Alarm Pro are good choices as are ... Sizing a Firewall for a client ...
      (Security-Basics)