Date: Fri, 17 Jan 2003 13:25:13 +0100 From: =?iso-8859-1?Q?Sten_Daniel_S=F8rsdal?= <sten.daniel.sorsdal@wan.no> To: "Josh Brooks" <user@mail.econolodgetulsa.com> Cc: <freebsd-hackers@FreeBSD.ORG> Subject: RE: FreeBSD firewall for high profile hosts - waste of time ? Message-ID: <0AF1BBDF1218F14E9B4CCE414744E70F07DE3A@exchange.wanglobal.net>
next in thread | raw e-mail | index | archive | help
What is the size of your pipe? If the pipe is big, then so should your BSD box be. The only time i've used something as small as 500ghz Celery it=20 was for a puny 10mbit. What kind of network adapters are you using? I cant recommend using anything other than Intel.=20 The drivers suck for the other cards. Have you applied POLLING (man polling)?=20 If the computer in itself chokes, this will in almost every case=20 prevent that. ( Requires cards such as Intel ) Do you filter outgoing packets so that your pipe wont be filled with = ICMP's or RST's on exit? Dummynet is good for that. If the incoming attack isnt = large enough to completely block your pipe one way, it often blocks on exit as the = responses go back. Do you limit the amount of ICMP responses on each of the servers? May i suggest using creative routing for packets on exit going to = unassigned or unroutable nets? How about getting a (perhaps smaller/cheaper) secondary pipe that also = announce your network often the attacks go in on one pipe but let the other pipe go free. - = This applies mainly when you are the one announcing the networks through BGP or in same = provider cases - OSPF. But yes, in my opinion, a FreeBSD firewall is worth using your time = with. ---------------------------------------=20 Med vennlig hilsen / Best regards=20 Sten Daniel S=F8rsdal=20 ---------------------------------------=20 -----Original Message----- From: Josh Brooks [mailto:user@mail.econolodgetulsa.com]=20 Sent: 16. januar 2003 23:42 To: Matthew Dillon Cc: Nate Williams; freebsd-hackers@FreeBSD.ORG Subject: Re: FreeBSD firewall for high profile hosts - waste of time ? > > If attacks are a predominant problem for you, I recommend sticking = a > machine in between your internet connection and everything else=20 > whos Actually this is what I already do - my ISP does all the routing, and it = feeds in one interface of my freebsd machine, and everything else is on = the other side of the freebsd machine. My freebsd machine does _nothing_ but filter packets and run ssh. > ONLY purpose is to deal with attacks. With an entire cpu = dedicated > to dealing with attacks you aren't likely to run out of CPU suds = (at least > not before your attackers fills your internet pipe). This allows = you > to use more reasonable rulesets on your other machines. You know, I keep hearing this ... the machine is a 500 mhz p3 celeron = with 256 megs ram ... and normally `top` says it is at about 80% idle, = and everything is wonderful - but when someone shoves 12,000-15,000 = packets per second down its throat, it chokes _hard_. You think that = optimizing my ruleset will change that ? Or does 15K p/s choke any = freebsd+ipfw firewall with 1-200 rules running on it ? thanks. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?0AF1BBDF1218F14E9B4CCE414744E70F07DE3A>