SYN Proxy for iptables?

SYN Proxy for iptables?

[Andrew Kraslavsky]

Hello,

For SYN flood protection, it seems OpenBSD's pf deploys something they call 
a "SYN proxy" whereby the 3 step TCP handshake is completed by this proxy so 
as to avoid SYN floods to the actual target.

This OpenBSD pf feature is described here:
http://www.openbsd.org/faq/pf/filter.html#synproxy

The target is only brought into the picture if and when the handshake is 
complete.

I guess pf must then adjust the real target's sequence numbers so as not to 
confuse the initiator of the connection.

Has something like this been implemented via iptables?

If not, are there any plans to do so?

Thanks,

- Andrew Kraslavsky

_________________________________________________________________
MSN is giving away a trip to Vegas to see Elton John.  Enter to win today. 
http://msnconcertcontest.com?icid-nceltontagline

Re: SYN Proxy for iptables?

[Wang, Baojun]

[-- Attachment #1: Type: text/plain, Size: 1797 bytes --]

Hope this solve this problem:

# This enables SYN flood protection.
# The SYN cookies activation allows your system to accept an unlimited
# number of TCP connections while still trying to give reasonable
# service during a denial of service attack.
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/tcp_syncookies
else
    $SYSCTL net.ipv4.tcp_syncookies="1"
fi

make sure `CONFIG_SYN_COOKIES' is compiled into the kernel while configuring 
the kernel.

On Tuesday 24 April 2007 03:24, Andrew Kraslavsky wrote:
> Hello,
>
> For SYN flood protection, it seems OpenBSD's pf deploys something they call
> a "SYN proxy" whereby the 3 step TCP handshake is completed by this proxy
> so as to avoid SYN floods to the actual target.
>
> This OpenBSD pf feature is described here:
> http://www.openbsd.org/faq/pf/filter.html#synproxy
>
> The target is only brought into the picture if and when the handshake is
> complete.
>
> I guess pf must then adjust the real target's sequence numbers so as not to
> confuse the initiator of the connection.
>
> Has something like this been implemented via iptables?
>
> If not, are there any plans to do so?
>
> Thanks,
>
> - Andrew Kraslavsky
>
> _________________________________________________________________
> MSN is giving away a trip to Vegas to see Elton John.� Enter to win today.
> http://msnconcertcontest.com?icid-nceltontagline

-- 
Wang, Baojun                                        Lanzhou University
Distributed & Embedded System Lab              http://dslab.lzu.edu.cn
School of Information Science and Engeneering        wangbj@lzu.edu.cn
Tianshui South Road 222. Lanzhou 730000                     .P.R.China
Tel:+86-931-8912025                                Fax:+86-931-8912022

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: SYN Proxy for iptables?

[Andrew Kraslavsky]

>Hope this solve this problem:
>
># This enables SYN flood protection.
># The SYN cookies activation allows your system to accept an unlimited
># number of TCP connections while still trying to give reasonable
># service during a denial of service attack.
>i f [ "$SYSCTL" = "" ]
>then
>    echo "1" > /proc/sys/net/ipv4/tcp_syncookies
>else
>    $SYSCTL net.ipv4.tcp_syncookies="1"
>fi
>
>make sure `CONFIG_SYN_COOKIES' is compiled into the kernel while 
>configuring the kernel.
>
>On Tuesday 24 April 2007 03:24, Andrew Kraslavsky wrote:

Thanks for the suggestion!

I do already use the tcp_syncookies option to protect the Linux box that is 
acting as my firewall.

What I am interested in here is a way to have that Linux firewall box help 
protect hosts that sit behind it from SYN floods.  These hosts are of a 
mixture of operating systems and I cannot guarantee that each one has 
sufficient protection against SYN flooding on its own so I am hoping that 
the Linux firewall box can help.

As far as I can tell, the tcp_syncookies option will only help the Linux 
firewall box itself and will not do anything to assist the hosts that the 
Linux box is being used to protect.


>>Hello,
>>
>>For SYN flood protection, it seems OpenBSD's pf deploys something they 
>>call
>>a "SYN proxy" whereby the 3 step TCP handshake is completed by this proxy
>>so as to avoid SYN floods to the actual target.
>>
>>This OpenBSD pf feature is described here:
>>http://www.openbsd.org/faq/pf/filter.html#synproxy
>>
>>The target is only brought into the picture if and when the handshake is
>>complete.
>>
>>I guess pf must then adjust the real target's sequence numbers so as not 
>>to
>>confuse the initiator of the connection.
>>
>>Has something like this been implemented via iptables?
>>
>>If not, are there any plans to do so?
>>
>>Thanks,
>>
>>- Andrew Kraslavsky

_________________________________________________________________
Mortgage rates near historic lows. Refinance $200,000 loan for as low as 
$771/month* 
https://www2.nextag.com/goto.jsp?product=100000035&url=%2fst.jsp&tm=y&search=mortgage_text_links_88_h27f8&disc=y&vers=689&s=4056&p=5117