Date: Tue, 20 May 2003 00:34:24 -0700 From: Avleen Vig <lists-freebsd@silverwraith.com> To: Ryan James <ryan@mac2.net> Cc: freebsd-security@freebsd.org Subject: Re: FreeBSD firewall block syn flood attack Message-ID: <20030520073424.GH49820@silverwraith.com> In-Reply-To: <BAEF3AC0.9998%ryan@mac2.net> References: <BAEF3AC0.9998%ryan@mac2.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, May 20, 2003 at 01:52:00AM -0500, Ryan James wrote: > Hello, > I current have a FreeBSD 4.8 bridge firewall that sits between 7 servers and > the internet. The servers are being attacked with syn floods and go down > multiple times a day. > > The 7 servers belong to a client, who runs redhat. > I am trying to find a way to do some kind of syn flood protection inside the > firewall. SYN floods are difficult to "protect" against. In the past, the only way I have been able to deal with them is to block all communication to the hosts being attacked, and allow communication again when the attack ends. The difficulty comes in when the attacker realises that you are effectively combatting the attack, and then proceeds to increase the ferocity of the attack until either all of our bandwidth is consumed, or your network equipment cannot handle the rate of packets coming in. Best thing to do is just take the hosts off the network. I normally use packet filter rules to achieve this.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030520073424.GH49820>