Re: FreeBSD firewall block syn flood attack

From: Greg Panula (greg.panula_at_dolaninformation.com)
Date: 05/20/03

  • Next message: Mike Silbersack: "Re: FreeBSD firewall block syn flood attack" 
    Date: Tue, 20 May 2003 07:36:17 -0500
To: Ryan James <ryan@mac2.net>

    Ryan James wrote:
    >
    > Hello,
    >
    > I current have a FreeBSD 4.8 bridge firewall that sits between 7 servers and
    > the internet. The servers are being attacked with syn floods and go down
    > multiple times a day.
    >
    > The 7 servers belong to a client, who runs redhat.
    >
    > I am trying to find a way to do some kind of syn flood protection inside the
    > firewall.
    >
    > Any suggestions would be greatly appreciated.

    Wouldn't syn cookies help in this situation? Since the firewall is a
    bridge, you would have to enable syn cookies on the affected redhat box.

    According to this link: http://cr.yp.to/syncookies.html
    linux supports syn cookies. ' echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    ' but are not enabled by default. I believe they are enabled by default
    on FreeBSD. :)

    Otherwise to use syn cookies at the firewall, the firewall would have to
    have syn cookies enabled(sysctl variable net.inet.tcp.syncookies) and
    nat the incoming traffic.

    I haven't done any testing of syn cookies' protection against syn floods
    but it is what they were designed for. :)

    good luck,
      greg
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Mike Silbersack: "Re: FreeBSD firewall block syn flood attack"

    Relevant Pages

    • Review: Steve Gibsons GENESIS
      ... Below is a review of Steve Gibson's GENESIS, as it is described on his ... GENESIS increases vulnerability to SYN flooding ... all the information of the SYN packet - it doesn't contain the TCP ... are the major differences between it and "SYN cookies" in Linux ...
      (comp.security.misc)
    • Review: Steve Gibsons GENESIS
      ... Below is a review of Steve Gibson's GENESIS, as it is described on his ... GENESIS increases vulnerability to SYN flooding ... all the information of the SYN packet - it doesn't contain the TCP ... are the major differences between it and "SYN cookies" in Linux ...
      (comp.security.firewalls)
    • Re: Review: Steve Gibsons GENESIS-part 2
      ... It is a way in which GENESIS is inferior to RC5. ... SYN cookies were not perfect, there's just better and they work. ... >> attacker and must be accepted by the server as genuine. ...
      (comp.security.misc)
    • Re: Review: Steve Gibsons GENESIS-part 2
      ... It is a way in which GENESIS is inferior to RC5. ... SYN cookies were not perfect, there's just better and they work. ... >> attacker and must be accepted by the server as genuine. ...
      (comp.security.firewalls)
    • Re: [fw-wiz] SYN flood protection strategies (Was: Post connection SYN)
      ... >> OR you set up the firewall to answer SYNs on behalf of the server ... I've moved the problem from servers with perhaps as low as 5 embryonic ... SYN sockets per port, that block for a full minute when the list is ... there are TCP stacks that handle SYN floods much better than ...
      (Firewall-Wizards)