From 8058eedf613e2d01bd102fb45a69e63c4df3acc5 Mon Sep 17 00:00:00 2001 From: Christoph Date: Fri, 30 Oct 2026 22:22:03 +0100 Subject: [PATCH] default_basic_behavior.conf: take of SYN FLOOD Rules. Disable SYN flood rule by default (IPv4 + IPv6) The global limit (1 SYN/s, burst 3, no per-source tracking) dropped legitimate TCP connections to the gateway itself (up to ~45% on busy gateways: DNS zone transfers, SSH, monitoring), and a few SYNs per second were enough to lock out all TCP access. Kernel SYN cookies (tcp_syncookies) already provide proper SYN flood protection. --- conf/default_basic_behavior.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conf/default_basic_behavior.conf b/conf/default_basic_behavior.conf index db743fb..cbd66d2 100644 --- a/conf/default_basic_behavior.conf +++ b/conf/default_basic_behavior.conf @@ -170,7 +170,7 @@ protect_against_several_attacks=true # Protection against syn-flooding # -drop_syn_flood=true +drop_syn_flood=false # - I have to say that fragments scare me more than anything. # - Sending lots of non-first fragments was what allowed Jolt2 to effectively "drown" @@ -233,7 +233,7 @@ protect6_against_several_attacks=true # Protection against syn-flooding # -drop6_syn_flood=true +drop6_syn_flood=false # drop new packages without syn flag #