Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 20 May 2003 00:34:24 -0700
From:      Avleen Vig <lists-freebsd@silverwraith.com>
To:        Ryan James <ryan@mac2.net>
Cc:        freebsd-security@freebsd.org
Subject:   Re: FreeBSD firewall block syn flood attack
Message-ID:  <20030520073424.GH49820@silverwraith.com>
In-Reply-To: <BAEF3AC0.9998%ryan@mac2.net>
References:  <BAEF3AC0.9998%ryan@mac2.net>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, May 20, 2003 at 01:52:00AM -0500, Ryan James wrote:
> Hello,
> I current have a FreeBSD 4.8 bridge firewall that sits between 7 servers and
> the internet. The servers are being attacked with syn floods and go down
> multiple times a day.
> 
> The 7 servers belong to a client, who runs redhat.
> I am trying to find a way to do some kind of syn flood protection inside the
> firewall. 

SYN floods are difficult to "protect" against.
In the past, the only way I have been able to deal with them is to block
all communication to the hosts being attacked, and allow communication
again when the attack ends.

The difficulty comes in when the attacker realises that you are
effectively combatting the attack, and then proceeds to increase the
ferocity of the attack until either all of our bandwidth is consumed, or
your network equipment cannot handle the rate of packets coming in.
Best thing to do is just take the hosts off the network. I normally use
packet filter rules to achieve this.



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030520073424.GH49820>