Re: FreeBSD firewall block syn flood attack

From: Mike Silbersack (silby_at_silby.com)
Date: 05/20/03

  • Next message: Tom Dymond - Ipnoz: "netstat/ipcs inside jail" 
    Date: Tue, 20 May 2003 08:45:34 -0500 (CDT)
To: jeremie le-hen <le-hen_j@epita.fr>

    On Tue, 20 May 2003, jeremie le-hen wrote:

    > Note that in fact, this might be achieved on your firewall (FreeBSD also
    > supports syncookies), but this would imply TCP SYN to be received by the
    > firewall itself, which in turn would forward the TCP connection to the
    > appropriate server once the connection would be fully established.
    > (I think a simple TCP tunnel with a NAT redirection to localhost should
    > work.)
    >
    > Regards,
    > --
    > Jeremie aka TtZ/TataZ
    > jeremie.le-hen@epita.fr

    You could certainly pull that off with an application level proxy, but the
    disadvantage would be that the server would no longer be able to determine
    the source IP of the machines connecting to it.

    It would be possible to add the syncache / syncookies to ipfw so that it
    could be used to protect hosts behind it, but I don't think anyone has
    tried an implementation of that yet.

    Mike "Silby" Silbersack
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: Tom Dymond - Ipnoz: "netstat/ipcs inside jail"

    Relevant Pages

    • Re: [2.6.24.3][net] bug: TCP 3rd handshake abnormal timeouts
      ... server via TCP and non-persistent connections and all application level ... "Sometimes" when establishing a TCP connection to the server, ... Here is a simplified version of what _both_ the server and the client ...
      (Linux-Kernel)
    • Re: [2.6.24.3][net] bug: TCP 3rd handshake abnormal timeouts
      ... server via TCP and non-persistent connections and all application level ... "Sometimes" when establishing a TCP connection to the server, ... Here is a simplified version of what _both_ the server and the client ...
      (Linux-Kernel)
    • [2.6.24.3][net] bug: TCP 3rd handshake abnormal timeouts
      ... The case is about a bunch of web servers accessing a MySQL database server via TCP and non-persistent connections and all application level errors have been excluded. ... "Sometimes" when establishing a TCP connection to the server, we are seeing a 3000ms delay before the connection if effectively made. ... Here is a simplified version of what _both_ the server and the client see. ...
      (Linux-Kernel)
    • Re: Dropped Sessions Pervasive v7
      ... Pervasive is a slave to the TCP stack -- if the TCP connection is lost, ... Looking in to the PVSW.LOG file on a client machine ... > connections to the database server being dropped. ...
      (comp.databases.btrieve)
    • Re: NAT and keepaliveopen connection over TCP
      ... sent after 10 minutes of inactivity on the TCP connection. ... There's no minimum set time how long a NAT router should ... time-out inactive connections at the server. ...
      (microsoft.public.win32.programmer.networks)