Synproxy - Revision history

Fmyhr: Added table of synproxy parameters.

2021-04-08T16:07:55Z

Added table of synproxy parameters.

@@ Line 39: / Line 39: @@
+}
 </source>
 The synproxy ''mss'' (maximum segment size) and ''wscale'' (window scale) settings must match those of your backend server. Synproxy does not attempt to determine these settings; you must find them using tcpdump as demonstrated in the [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] in ''Example ruleset for synproxy statement''.

Fmyhr: Added note referencing man page to determine synproxy mss and ws.

2021-04-08T15:43:48Z

Added note referencing man page to determine synproxy mss and ws.

← Older revision		Revision as of 15:43, 8 April 2021
Line 39:		Line 39:
	}		}
	</source>		</source>

			The synproxy ''mss'' (maximum segment size) and ''wscale'' (window scale) settings must match those of your backend server. Synproxy does not attempt to determine these settings; you must find them using tcpdump as demonstrated in the [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] in ''Example ruleset for synproxy statement''.

	Support for anonymous ''synproxy'' was added in [https://marc.info/?l=netfilter&m=156621590113089&w=2 nftables 0.9.2].		Support for anonymous ''synproxy'' was added in [https://marc.info/?l=netfilter&m=156621590113089&w=2 nftables 0.9.2].

Fmyhr: Intro: added more sysctl settings.

2021-04-08T15:34:13Z

Intro: added more sysctl settings.

← Older revision		Revision as of 15:34, 8 April 2021
Line 1:		Line 1:
	A netfilter synproxy intercepts new TCP connections and handles the initial 3-way handshake using syncookies instead of [[Connection_Tracking_System\|conntrack]] to establish the connection. Running synproxy on a listening server port thus prevents a [https://en.wikipedia.org/wiki/SYN_flood SYN flood] attack on that port from consuming limited conntrack resources.		A netfilter synproxy intercepts new TCP connections and handles the initial 3-way handshake using syncookies instead of [[Connection_Tracking_System\|conntrack]] to establish the connection. Running synproxy on a listening server port thus prevents a [https://en.wikipedia.org/wiki/SYN_flood SYN flood] attack on that port from consuming limited conntrack resources.

	~~When using~~ synproxy ~~it is important to disable~~ the conntrack loose tracking option:		Using synproxy requires disabling the conntrack loose tracking option:
	<source>		<source>
	% echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose		% echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
	</source>		</source>
	With this setting the final handshake ACK from the remote host will be marked INVALID and won't create a new conntrack entry. In our accept rule for such connections we explicitly accept these "INVALID" packets and pass them along to our listening service (see examples below).		With this setting the final handshake ACK from the remote host will be marked INVALID and won't create a new conntrack entry. In our accept rule for such connections we explicitly accept these "INVALID" packets and pass them along to our listening service (see examples below).

			Also, because synproxy relies on syncookies and tcp timestamps, ensure these are enabled:
			<source>
			% echo 1 > /proc/sys/net/ipv4/tcp_syncookies
			% echo 1 > /proc/sys/net/ipv4/tcp_timestamps
			</source>

			You may also want to increase conntrack resources:
			* /sys/module/nf_conntrack/parameters/hashsize
			* /proc/sys/net/netfilter/nf_conntrack_max

Fmyhr: Linked DDoS protection using synproxy external page.

2021-04-08T15:25:06Z

Linked DDoS protection using synproxy external page.

← Older revision		Revision as of 15:25, 8 April 2021
Line 72:		Line 72:
	* [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] Example ruleset for synproxy statement		* [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] Example ruleset for synproxy statement
	* [https://lwn.net/Articles/563151/ 2013 patchset announcement with detailed description of synproxy operation]		* [https://lwn.net/Articles/563151/ 2013 patchset announcement with detailed description of synproxy operation]
			* [https://www.dbsysnet.com/homemade-ddos-protection-using-iptables-synproxy/ DDoS Protection Using Synproxy], uses iptables but synproxy operation is the same using nftables

Fmyhr: Intro: added note to disable nf_conntrack_tcp_loose.

2021-04-08T15:14:47Z

Intro: added note to disable nf_conntrack_tcp_loose.

← Older revision		Revision as of 15:14, 8 April 2021
Line 1:		Line 1:
	A netfilter synproxy intercepts new TCP connections and handles the initial 3-way handshake using syncookies instead of [[Connection_Tracking_System\|conntrack]] to establish the connection. Running synproxy on a listening server port thus prevents a [https://en.wikipedia.org/wiki/SYN_flood SYN flood] attack on that port from consuming limited conntrack resources.		A netfilter synproxy intercepts new TCP connections and handles the initial 3-way handshake using syncookies instead of [[Connection_Tracking_System\|conntrack]] to establish the connection. Running synproxy on a listening server port thus prevents a [https://en.wikipedia.org/wiki/SYN_flood SYN flood] attack on that port from consuming limited conntrack resources.

			When using synproxy it is important to disable the conntrack loose tracking option:
			<source>
			% echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
			</source>
			With this setting the final handshake ACK from the remote host will be marked INVALID and won't create a new conntrack entry. In our accept rule for such connections we explicitly accept these "INVALID" packets and pass them along to our listening service (see examples below).

Fmyhr: Linked early synproxy patchset announcemen with detailed operational description.

2021-04-08T01:44:57Z

Linked early synproxy patchset announcemen with detailed operational description.

← Older revision		Revision as of 01:44, 8 April 2021
Line 65:		Line 65:
	= See also =		= See also =
	* [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] Example ruleset for synproxy statement		* [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] Example ruleset for synproxy statement
			* [https://lwn.net/Articles/563151/ 2013 patchset announcement with detailed description of synproxy operation]

Fmyhr: Link manpage example synproxy ruleset.

2021-04-08T01:40:12Z

Link manpage example synproxy ruleset.

← Older revision		Revision as of 01:40, 8 April 2021
Line 61:		Line 61:

	Support for using ''synproxy'' named objects was added in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3].		Support for using ''synproxy'' named objects was added in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3].


			= See also =
			* [https://www.netfilter.org/projects/nftables/manpage.html nft manpage] Example ruleset for synproxy statement

Fmyhr: Added intro and anonymous synproxy section.

2021-04-08T01:34:43Z

Added intro and anonymous synproxy section.

@@ Line 1: / Line 1: @@
 <source>
@@ Line 32: / Line 60: @@
 </source>
-Support for using ''synproxy'' objects in maps was added in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables&nbsp;0.9.3].
+Support for using ''synproxy'' named objects was added in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables&nbsp;0.9.3].

Fmyhr: Just a stub with example from nftables 0.9.3 release notes. Not ready for linking yet!

2021-04-07T21:16:28Z

Just a stub with example from nftables 0.9.3 release notes. Not ready for linking yet!

New page

<source>
table ip foo {

synproxy https-synproxy {
mss 1460
wscale 7
timestamp sack-perm
}

synproxy other-synproxy {
mss 1460
wscale 5
}

chain pre {
type filter hook prerouting priority raw; policy accept;

tcp dport 8888 tcp flags syn notrack
}

chain bar {
type filter hook forward priority filter; policy accept;

ct state invalid,untracked synproxy name ip saddr map {
192.168.1.0/24 : "https-synproxy",
192.168.2.0/24 : "other-synproxy",
}
}
}
</source>

Support for using ''synproxy'' objects in maps was added in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3].