* Syn Flood and DDoS Protect @ 2014-03-11 7:23 Thiago Oliveira 2014-03-11 11:19 ` Jesper Dangaard Brouer 0 siblings, 1 reply; 6+ messages in thread From: Thiago Oliveira @ 2014-03-11 7:23 UTC (permalink / raw) To: netfilter Hi All, I am looking for to add protection to firewall (IPTABLES based) specifically for SYN flood and DDoS attack to start with and, to that end, was trawling through the archives of this mailing lists and other places Google suggested I visit. Unfortunately, what I found suggests that there is some debate about how best to approach this. Specifically, many postings suggest using a 'limit' module or TCP flag combinations, but other postingssay that such rules will not help and in fact may even themselves act as a kind of internal DoS! So my question is, has there been a resolution to this case? Can I protect my Linux Firewall using IPTABLES? Many Thanks, Thiago Oliveira ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Syn Flood and DDoS Protect 2014-03-11 7:23 Syn Flood and DDoS Protect Thiago Oliveira @ 2014-03-11 11:19 ` Jesper Dangaard Brouer 2014-03-11 15:24 ` Phil Oester ` (2 more replies) 0 siblings, 3 replies; 6+ messages in thread From: Jesper Dangaard Brouer @ 2014-03-11 11:19 UTC (permalink / raw) To: Thiago Oliveira; +Cc: netfilter On Tue, 11 Mar 2014 04:23:39 -0300 Thiago Oliveira <cpv.thiago@gmail.com> wrote: > I am looking for to add protection to firewall (IPTABLES based) > specifically for SYN flood and DDoS attack to start with and, to that > end, was trawling through the archives of this mailing lists and other > places Google suggested I visit. > > Unfortunately, what I found suggests that there is some debate about > how best to approach this. > Specifically, many postings suggest using a 'limit' module or TCP flag > combinations, but other postingssay that such rules will not help and > in fact may even themselves act as a kind of internal DoS! Yes, unfortunately many of the iptables modules with state, have not (yet) been optimized for parallel processing (this is work in progress, at some point they will hopefully all scale and avoid serialization on their internal state). Note, normal/simple iptables rules without state is capable of parallel processing. > So my question is, has there been a resolution to this case? Can I > protect my Linux Firewall using IPTABLES? You are in luck. I recently gave a talk on the subject of using iptables/netfilter to protect against SYN-flood DoS attacks. We have recently developed a module called SYNPROXY that address this. YouTube videos: https://www.youtube.com/watch?v=BklSqr9t4uA Slides: http://people.netfilter.org/hawk/presentations/devconf2014/ Script: https://github.com/netoptimizer/network-testing/blob/master/iptables/iptables_synproxy.sh And extra (not in slides) is that I recently optimized conntrack new-and-del operations, by implementing "parallel" locking. These changes will appear in kernel 3.14. http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/51681 I would appreciate if people can test these recent conntrack optimizations, the kernel code is avail in Pablo's nf-next tree: https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/ I'm willing to help to provide build kernels for your system, if you can try/test these changes in production... -- Best regards, Jesper Dangaard Brouer MSc.CS, Sr. Network Kernel Developer at Red Hat Author of http://www.iptv-analyzer.org LinkedIn: http://www.linkedin.com/in/brouer ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Syn Flood and DDoS Protect 2014-03-11 11:19 ` Jesper Dangaard Brouer @ 2014-03-11 15:24 ` Phil Oester 2014-03-11 16:35 ` Thiago Oliveira 2014-03-11 17:12 ` Thiago Oliveira 2 siblings, 0 replies; 6+ messages in thread From: Phil Oester @ 2014-03-11 15:24 UTC (permalink / raw) To: Jesper Dangaard Brouer; +Cc: Thiago Oliveira, netfilter On Tue, Mar 11, 2014 at 12:19:32PM +0100, Jesper Dangaard Brouer wrote: > And extra (not in slides) is that I recently optimized conntrack > new-and-del operations, by implementing "parallel" locking. These > changes will appear in kernel 3.14. ITYM 3.15. Phil ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Syn Flood and DDoS Protect 2014-03-11 11:19 ` Jesper Dangaard Brouer 2014-03-11 15:24 ` Phil Oester @ 2014-03-11 16:35 ` Thiago Oliveira 2014-03-11 17:12 ` Thiago Oliveira 2 siblings, 0 replies; 6+ messages in thread From: Thiago Oliveira @ 2014-03-11 16:35 UTC (permalink / raw) To: Jesper Dangaard Brouer; +Cc: netfilter The Great Jesper, After my post here, I came across your video and slide! I did the download, and probably tonight (UTC -3) I will learn about and implement into my firewalls. I will let you know about that. Thank you! Thiago On Tue, Mar 11, 2014 at 8:19 AM, Jesper Dangaard Brouer <netdev@brouer.com> wrote: > On Tue, 11 Mar 2014 04:23:39 -0300 > Thiago Oliveira <cpv.thiago@gmail.com> wrote: > >> I am looking for to add protection to firewall (IPTABLES based) >> specifically for SYN flood and DDoS attack to start with and, to that >> end, was trawling through the archives of this mailing lists and other >> places Google suggested I visit. >> >> Unfortunately, what I found suggests that there is some debate about >> how best to approach this. >> Specifically, many postings suggest using a 'limit' module or TCP flag >> combinations, but other postingssay that such rules will not help and >> in fact may even themselves act as a kind of internal DoS! > > Yes, unfortunately many of the iptables modules with state, have not > (yet) been optimized for parallel processing (this is work in progress, > at some point they will hopefully all scale and avoid serialization on > their internal state). Note, normal/simple iptables rules without > state is capable of parallel processing. > > >> So my question is, has there been a resolution to this case? Can I >> protect my Linux Firewall using IPTABLES? > > You are in luck. I recently gave a talk on the subject of using > iptables/netfilter to protect against SYN-flood DoS attacks. We have > recently developed a module called SYNPROXY that address this. > > YouTube videos: > https://www.youtube.com/watch?v=BklSqr9t4uA > > Slides: > http://people.netfilter.org/hawk/presentations/devconf2014/ > > Script: > https://github.com/netoptimizer/network-testing/blob/master/iptables/iptables_synproxy.sh > > And extra (not in slides) is that I recently optimized conntrack > new-and-del operations, by implementing "parallel" locking. These > changes will appear in kernel 3.14. > http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/51681 > > I would appreciate if people can test these recent conntrack > optimizations, the kernel code is avail in Pablo's nf-next tree: > > https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/ > > I'm willing to help to provide build kernels for your system, if you > can try/test these changes in production... > > -- > Best regards, > Jesper Dangaard Brouer > MSc.CS, Sr. Network Kernel Developer at Red Hat > Author of http://www.iptv-analyzer.org > LinkedIn: http://www.linkedin.com/in/brouer ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Syn Flood and DDoS Protect 2014-03-11 11:19 ` Jesper Dangaard Brouer 2014-03-11 15:24 ` Phil Oester 2014-03-11 16:35 ` Thiago Oliveira @ 2014-03-11 17:12 ` Thiago Oliveira 2014-03-12 8:42 ` Jesper Dangaard Brouer 2 siblings, 1 reply; 6+ messages in thread From: Thiago Oliveira @ 2014-03-11 17:12 UTC (permalink / raw) To: Jesper Dangaard Brouer; +Cc: netfilter Mr. Jesper, I had a time now and I did execute the script SYN-PROXY and getting this Ouput. root@spweb02:~# ./syn-proxy.sh -v -i eth0 -p 80 WARNING: Shell env variable IPTABLES_CMD is undefined WARNING: Fallback to default IPTABLES_CMD=/sbin/iptables iptables: No chain/target/match by that name. WARNING -- Error (1) when executing the iptables command: "iptables -t raw -I PREROUTING -i eth0 -p tcp -m tcp --syn --dport 80 -j CT --notrack" iptables v1.4.8: unknown option `--sack-perm' Try `iptables -h' or 'iptables --help' for more information. WARNING -- Error (2) when executing the iptables command: "iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460" iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state INVALID -j DROP Maybe my iptables version doesn't support this? Thiago On Tue, Mar 11, 2014 at 8:19 AM, Jesper Dangaard Brouer <netdev@brouer.com> wrote: > On Tue, 11 Mar 2014 04:23:39 -0300 > Thiago Oliveira <cpv.thiago@gmail.com> wrote: > >> I am looking for to add protection to firewall (IPTABLES based) >> specifically for SYN flood and DDoS attack to start with and, to that >> end, was trawling through the archives of this mailing lists and other >> places Google suggested I visit. >> >> Unfortunately, what I found suggests that there is some debate about >> how best to approach this. >> Specifically, many postings suggest using a 'limit' module or TCP flag >> combinations, but other postingssay that such rules will not help and >> in fact may even themselves act as a kind of internal DoS! > > Yes, unfortunately many of the iptables modules with state, have not > (yet) been optimized for parallel processing (this is work in progress, > at some point they will hopefully all scale and avoid serialization on > their internal state). Note, normal/simple iptables rules without > state is capable of parallel processing. > > >> So my question is, has there been a resolution to this case? Can I >> protect my Linux Firewall using IPTABLES? > > You are in luck. I recently gave a talk on the subject of using > iptables/netfilter to protect against SYN-flood DoS attacks. We have > recently developed a module called SYNPROXY that address this. > > YouTube videos: > https://www.youtube.com/watch?v=BklSqr9t4uA > > Slides: > http://people.netfilter.org/hawk/presentations/devconf2014/ > > Script: > https://github.com/netoptimizer/network-testing/blob/master/iptables/iptables_synproxy.sh > > And extra (not in slides) is that I recently optimized conntrack > new-and-del operations, by implementing "parallel" locking. These > changes will appear in kernel 3.14. > http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/51681 > > I would appreciate if people can test these recent conntrack > optimizations, the kernel code is avail in Pablo's nf-next tree: > > https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/ > > I'm willing to help to provide build kernels for your system, if you > can try/test these changes in production... > > -- > Best regards, > Jesper Dangaard Brouer > MSc.CS, Sr. Network Kernel Developer at Red Hat > Author of http://www.iptv-analyzer.org > LinkedIn: http://www.linkedin.com/in/brouer ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Syn Flood and DDoS Protect 2014-03-11 17:12 ` Thiago Oliveira @ 2014-03-12 8:42 ` Jesper Dangaard Brouer 0 siblings, 0 replies; 6+ messages in thread From: Jesper Dangaard Brouer @ 2014-03-12 8:42 UTC (permalink / raw) To: Thiago Oliveira; +Cc: brouer, netfilter On Tue, 11 Mar 2014 14:12:37 -0300 Thiago Oliveira <cpv.thiago@gmail.com> wrote: > Mr. Jesper, > > I had a time now and I did execute the script SYN-PROXY and getting this Output. > > root@spweb02:~# ./syn-proxy.sh -v -i eth0 -p 80 > WARNING: Shell env variable IPTABLES_CMD is undefined > WARNING: Fallback to default IPTABLES_CMD=/sbin/iptables > iptables: No chain/target/match by that name. > WARNING -- Error (1) when executing the iptables command: > "iptables -t raw -I PREROUTING -i eth0 -p tcp -m tcp --syn --dport 80 > -j CT --notrack" > iptables v1.4.8: unknown option `--sack-perm' > Try `iptables -h' or 'iptables --help' for more information. > WARNING -- Error (2) when executing the iptables command: > "iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state > INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss > 1460" > iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state > INVALID -j DROP > > Maybe my iptables version doesn't support this? Exactly... you need iptables v1.4.21, you can run the commands below: wget http://www.netfilter.org/projects/iptables/files/iptables-1.4.21.tar.bz2 tar xvf iptables-1.4.21.tar.bz2 cd iptables-1.4.21/ ./configure && make sudo make install Remember you also need a newer kernel... minimum kernel 3.13, but preferably the upcoming nf-next kernel, for the conntrack scaling: https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/ git clone git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git cd nf-next/ make menuconfig #(select all netfilter modules) make -j24 make install #(depend on your distro) #On Debian perhaps also run these: export VER=`cat include/config/kernel.release` depmod -a ${VER} mkinitramfs -o /boot/initrd.img-$VER $VER update-grub2 # (reboot and select kernel) Good luck, fighting your DDoS... --Jesper > On Tue, Mar 11, 2014 at 8:19 AM, Jesper Dangaard Brouer > <netdev@brouer.com> wrote: > > On Tue, 11 Mar 2014 04:23:39 -0300 > > Thiago Oliveira <cpv.thiago@gmail.com> wrote: > > > >> I am looking for to add protection to firewall (IPTABLES based) > >> specifically for SYN flood and DDoS attack to start with and, to that > >> end, was trawling through the archives of this mailing lists and other > >> places Google suggested I visit. > >> > >> Unfortunately, what I found suggests that there is some debate about > >> how best to approach this. > >> Specifically, many postings suggest using a 'limit' module or TCP flag > >> combinations, but other postingssay that such rules will not help and > >> in fact may even themselves act as a kind of internal DoS! > > > > Yes, unfortunately many of the iptables modules with state, have not > > (yet) been optimized for parallel processing (this is work in progress, > > at some point they will hopefully all scale and avoid serialization on > > their internal state). Note, normal/simple iptables rules without > > state is capable of parallel processing. > > > > > >> So my question is, has there been a resolution to this case? Can I > >> protect my Linux Firewall using IPTABLES? > > > > You are in luck. I recently gave a talk on the subject of using > > iptables/netfilter to protect against SYN-flood DoS attacks. We have > > recently developed a module called SYNPROXY that address this. > > > > YouTube videos: > > https://www.youtube.com/watch?v=BklSqr9t4uA > > > > Slides: > > http://people.netfilter.org/hawk/presentations/devconf2014/ > > > > Script: > > https://github.com/netoptimizer/network-testing/blob/master/iptables/iptables_synproxy.sh > > > > And extra (not in slides) is that I recently optimized conntrack > > new-and-del operations, by implementing "parallel" locking. These > > changes will appear in kernel 3.14. > > http://thread.gmane.org/gmane.comp.security.firewalls.netfilter.devel/51681 > > > > I would appreciate if people can test these recent conntrack > > optimizations, the kernel code is avail in Pablo's nf-next tree: > > > > https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/ > > > > I'm willing to help to provide build kernels for your system, if you > > can try/test these changes in production... > > > > -- > > Best regards, > > Jesper Dangaard Brouer > > MSc.CS, Sr. Network Kernel Developer at Red Hat > > Author of http://www.iptv-analyzer.org > > LinkedIn: http://www.linkedin.com/in/brouer -- Best regards, Jesper Dangaard Brouer MSc.CS, Sr. Network Kernel Developer at Red Hat Author of http://www.iptv-analyzer.org LinkedIn: http://www.linkedin.com/in/brouer ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-03-12 8:42 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-03-11 7:23 Syn Flood and DDoS Protect Thiago Oliveira 2014-03-11 11:19 ` Jesper Dangaard Brouer 2014-03-11 15:24 ` Phil Oester 2014-03-11 16:35 ` Thiago Oliveira 2014-03-11 17:12 ` Thiago Oliveira 2014-03-12 8:42 ` Jesper Dangaard Brouer
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.