Syncookied on linux router

[JOSEFGRILL]

Hello,
is possible use Syncookied (directly) on linux router?

[polachok]

Hi,
can you be more specific at what exactly do you want to achieve?

[JOSEFGRILL]

Hi, Thank you for your response.

I mean cleaning process without additional server and without traffic diversion. Cleaning process directly on linux router.

We have linux router with Debian 8 (before webservers). We need protect these webservers continuously. Is possible use Syncookied on this router for each incoming packet?

If attack is strong we are using a traffic diversion in routing and this traffic (attack) is transfered to special router with synproxy. Synproxy make mittigation and clean traffic is transfered to our network.

Our servers are under small TCP+SYN (SYN+ACK etc.) attacks anytime and we need clean these small attacks anytime.

[polachok]

syncookied requires a dedicated network card which will be disconnected from linux network stack.
If you have a supported card installed in your router which is not used, you can use it for syncookied and configure your router to transfer traffic to this port for filtering.

Bear in mind that syncookied is designed for large attacks (i.e. it will waste CPU resources when idle) and you may be better suited by linux synproxy functionality in case your attack is small.

[JOSEFGRILL]

We have one empty 10 Gbps card now and we can add a dedicated network card. This isn't problem. How we can use this hardware? How setup this correctly? We need use this dedicated card for Syncokieed and clear traffic we need send back to router (to normal way and process these packets in iptables for example). Can you explain this, please?

We have router with strong CPU and full of RAM. We are using "-j CT --notrack" for all packets in iptables normally and router is working fine. CPU has load 0.1 and "si" is around 0.5 for example. We can use this CPU for Syncookied. Router is slow if we used synproxy because we can't use "-j CT --notrack" for all packets.

For example we have 300 IPv4 with webservers and each is receiving around 150-500 TCP+SYN (or similar) pps. This isn't big number but this is 45-150.000 per second not valid TCP+SYN packets (going thru router). Stronger attacks (to single IP) are transfered to synproxy filter.