how to implement "SYN Proxy firewall"with syn cookies for "Preventing syn flood

how to implement "SYN Proxy firewall"with syn cookies for "Preventing syn flood

[陈志峰]

i am a newman for linux.

recently i want to implement "SYN Proxy firewall"with syn cookies for
"Preventing

SYN Flood".

but i do not know how to implement it?

Please help me. Thank you for any answer and any question. 

can you give me a particular answer and some code? can i implement it
on netfilter-

iptable? how implement?

Re: how to implement "SYN Proxy firewall"with syn cookies for "Preventing syn flood

[Song Du]

try searching the ml.
imho, netfilter is not such a heal-all, things like "syn proxy" maybe
to complex, just try something simple like limit.

2005/4/28, 陈志峰 <aaafeng@gmail.com>:
> i am a newman for linux.
> 
> recently i want to implement "SYN Proxy firewall"with syn cookies for
> "Preventing
> 
> SYN Flood".
> 
> but i do not know how to implement it?
> 
> Please help me. Thank you for any answer and any question.
> 
> can you give me a particular answer and some code? can i implement it
> on netfilter-
> 
> iptable? how implement?
> 
> 


-- 
freewizard (at) gmail.com 
http://blog.tsing.org/freewizard/

Re: how to implement "SYN Proxy firewall"with syn cookies for "Preventing syn flood

[Henrik Nordstrom]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: TEXT/PLAIN; charset=X-UNKNOWN; format=flowed, Size: 612 bytes --]

On Thu, 28 Apr 2005, [GB2312] ³ÂÖ¾·å wrote:

> recently i want to implement "SYN Proxy firewall"with syn cookies for
> "Preventing
>
> SYN Flood".
>
> but i do not know how to implement it?

The simplest approach would be TPROXY with a good user-space proxy (TPROXY 
aware), running with SYN-cookies enabled.

If you do not require the original client IP to be preserved during an 
attack then a good user-space proxy is sufficient, used in conjunction 
with the standard REDIRECT target.

In both cases a limit match is useful to define a threshold when to start 
proxying.

Regards
Henrik