firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

default_basic_behavior.conf: take of SYN FLOOD Rules. Disable SYN flood rule by default (IPv4 + IPv6)

Browse Source 
The global limit (1 SYN/s, burst 3, no per-source tracking) dropped
legitimate TCP connections to the gateway itself (up to ~45% on busy
gateways: DNS zone transfers, SSH, monitoring), and a few SYNs per
second were enough to lock out all TCP access. Kernel SYN cookies
(tcp_syncookies) already provide proper SYN flood protection.
This commit is contained in:
chris
2026-10-30 22:22:03 +01:00
parent 75273e68bf
commit 8058eedf61
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/default_basic_behavior.conf
+2 -2
View File
@@ -170,7 +170,7 @@ protect_against_several_attacks=true
# Protection against syn-flooding # Protection against syn-flooding
# #
drop_syn_flood=true drop_syn_flood=false
# - I have to say that fragments scare me more than anything. # - I have to say that fragments scare me more than anything.
# - Sending lots of non-first fragments was what allowed Jolt2 to effectively "drown" # - Sending lots of non-first fragments was what allowed Jolt2 to effectively "drown"
@@ -233,7 +233,7 @@ protect6_against_several_attacks=true
# Protection against syn-flooding # Protection against syn-flooding
# #
drop6_syn_flood=true drop6_syn_flood=false
# drop new packages without syn flag # drop new packages without syn flag
# #