What is the size of your pipe?
If the pipe is big, then so should your BSD box be.
The only time i've used something as small as 500ghz Celery it
was for a puny 10mbit.
What kind of network adapters are you using?
I cant recommend using anything other than Intel.
The drivers suck for the other cards.
Have you applied POLLING (man polling)?
If the computer in itself chokes, this will in almost every case
prevent that. ( Requires cards such as Intel )
Do you filter outgoing packets so that your pipe wont be filled with ICMP's or
RST's on exit? Dummynet is good for that. If the incoming attack isnt large enough
to completely block your pipe one way, it often blocks on exit as the responses
go back.
Do you limit the amount of ICMP responses on each of the servers?
May i suggest using creative routing for packets on exit going to unassigned or
unroutable nets?
How about getting a (perhaps smaller/cheaper) secondary pipe that also announce your
network
often the attacks go in on one pipe but let the other pipe go free. - This applies
mainly
when you are the one announcing the networks through BGP or in same provider cases -
OSPF.
But yes, in my opinion, a FreeBSD firewall is worth using your time with.
---------------------------------------
Med vennlig hilsen / Best regards
Sten Daniel Sørsdal
---------------------------------------
-----Original Message-----
From: Josh Brooks [mailto:[EMAIL PROTECTED]]
Sent: 16. januar 2003 23:42
To: Matthew Dillon
Cc: Nate Williams; [EMAIL PROTECTED]
Subject: Re: FreeBSD firewall for high profile hosts - waste of time ?
>
> If attacks are a predominant problem for you, I recommend sticking a
> machine in between your internet connection and everything else
> whos
Actually this is what I already do - my ISP does all the routing, and it feeds in one
interface of my freebsd machine, and everything else is on the other side of the
freebsd machine.
My freebsd machine does _nothing_ but filter packets and run ssh.
> ONLY purpose is to deal with attacks. With an entire cpu dedicated
> to dealing with attacks you aren't likely to run out of CPU suds (at least
> not before your attackers fills your internet pipe). This allows you
> to use more reasonable rulesets on your other machines.
You know, I keep hearing this ... the machine is a 500 mhz p3 celeron with 256 megs
ram ... and normally `top` says it is at about 80% idle, and everything is wonderful -
but when someone shoves 12,000-15,000 packets per second down its throat, it chokes
_hard_. You think that optimizing my ruleset will change that ? Or does 15K p/s
choke any freebsd+ipfw firewall with 1-200 rules running on it ?
thanks.
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message
