RE: ..prevention, was: syn DDoS attack solution

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



As promised, I wrote a blog entry on the blocking the bogon IP's and
included the full set of Iptables rules.
http://cobia.typepad.com/cobia_community_blog/how_to_use_cobia/index.htm
l

Thanks,

Martin    


Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
martin@xxxxxxxxxxxxxxx
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx
[mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Martin
McKeay
Sent: Thursday, June 07, 2007 12:42 PM
To: netfilter@xxxxxxxxxxxxxxxxxxx
Subject: RE: ..prevention, was: syn DDoS attack solution

I writing a blog post about the rules for blocking the bogon IP's
(unused IP networks) using the firewall module of our Cobia,  I was
considering including the equivalent iptables rules.  Would this be of
interest to anyone?


Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
martin@xxxxxxxxxxxxxxx
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx
[mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Steven M
Campbell
Sent: Tuesday, June 05, 2007 9:41 AM
To: Arnt Karlsen
Cc: netfilter@xxxxxxxxxxxxxxxxxxx
Subject: Re: ..prevention, was: syn DDoS attack solution

Arnt Karlsen wrote:
> On Tue, 05 Jun 2007 10:16:40 -0400, Steven wrote in message
> <46657048.4040600@xxxxxxxxxxxxx>:
>
>   
>> And, most important for folks here, do egress filtering on your 
>> firewall!    Help prevent zombie machines on your own networks from 
>> being a problem, you can't stop your end users from bringing 
>> infections into your network but you can control their spread.
>>     
>
> ..what tricks _are_ out there?  Set up some kinda p0f deamon and cut 
> 'n tarpit any and all Wintendo network traffic attempts?
> Or even feed them LROS thru ActiveX if they need firm hints?
>
>   

Not really very tricky, limit outbound traffic to what is needed.   Do 
all of your workstations need UDP ports outbound?  Smtp?    For a lot of

sites the average workstations internet requirements are very small,
especially if proxys are used for SMTP,HTTP,FTP, etc.  Just by blocking
most of the end users from direct internet access (or at least to a
small set of outbound protocol/ports) we render those machines pretty
useless to the bad guys. 

It does, however, become very tricky if it's not done up front.  It's
really really tough to figure out what the requirements are if anyone 
could historically do anything they wanted.    It's far better to 
seriously restrict things up front and put in the exceptions as you find

them.   Sites that have historically allowed all outbound traffic are a 
two fold problem, it's hard to fix and they are exactly the sorts of
sites the bad guys like to use.






[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux