Hi,

I'm facing a DDOS on one of my servers with centos installed that hosts few websites, and I figured out to put OpenBSD or FreeBSD and configure pf with synproxy, like the *BSD is in the front with two network interfaces- public and private- with some nat rules to centos, could this solve the problem or reduce it at least?


Thanks in advance.

Have you enabled iptables rules to eliminate as much traffic as you can? Have you given mod_evasive a try? Have you reconfigured the spawned clients, timeouts, etc to help apache deal with the syn attacks? What kind of hardware are you dealing with? How large is the ddos (how many connecting hosts)? How is your network holding up against the ddos? Is the machine having problems or the network itself?

On a large ddos everything becomes moot more or a less, but on a small to moderate sized one even a single machine can take a lot of measures to minimize the damage. A firewall in front is definitely a good idea, but there is a lot you should look at before that even.

A few quickies to try:
http://www.cyberciti.biz/tips/linux-...on-attack.html
http://www.cyberciti.biz/tips/howto-...n-attacks.html
http://forums.devshed.com/security-a...er-277224.html

We've covered DoS and DDoS options in the Linux Security forum extensively. Please search for threads on the subject. I'm sorry to say but you'll find that, regardless the type, host-based measures simply won't cut it: you'll want to involve upstream for filtering, limiting or temporarily severing the pipe.

I'd love to see hard data first. A lot of the time, people assume they are DoS'd but its actually something else. For instance, I'm pretty sure that most people would think they're being DoS'd if they've a mail server that is misconfigured and in an open-relay state.

Details first, so we can help and assess if this is even a DoS/DDoS issue.

1 members found this post helpful.