specify the entire subnet as a source... like:but still, remember that limiting SYN packets with the general limit rules you posted is gonna affect them all, including the ones that aren't part of the flood...

I used the
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
command.

I'm am just so lost and confused right now. Here is my setup. I have one computer that has the iptables running on it along with a server and a few test pages. I have another computer that is running the syn flood attack. I have a third computer that is accessing the server and trying to get access to the webpages. All of the computers are hooked up through a router.

Does anyone have any advice?

Also, can someone tell me where I can view the configuration file for iptables in red hat?

Thanks everyone...

I just viewed my configuration file and this is what it looks like:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT- [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -dport 23 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT


can someone please help me configure this thing.

AFAIK if you use that command along with the general SYN packet limit rules, then you'd still be limiting SYN packets for non-flood connections - so the server would still appear sluggish to the clients trying to establish normal connections... try using the tcp_syncookies without using the limiting SYN packet rules...

i'm not sure where it's stored in redhat (just google it), but you can store them wherever you want when you run the iptables-save command... and you can then pick-them-up with the iptables-restore command... if you want to look at your *current* configuration just run a command like:

BTW: if the "syn flood generator" and the web server are on the same LAN then it really doesn't matter what you do on the router/firewall... you need to have the two boxes on separate networks for the simulation to work (if you are doing this on the router)...

also, why is your INPUT policy set to ACCEPT?? same question for the FORWARD chain...

could you explain why this is? It's obvious that you know more than I do so I would like to understand. thanks...

I'm not sure why the input and forward chains are set to accept. This is the initial setup configuration on this computer. What should it be set to?

because by nature a firewall/router can only filter traffic BETWEEN networks... machines on the same LAN do not need to send packets through a router in order to communicate, they can do so directly... in practical terms, boxes on a lan only rely on the switch/hub for communication (and on their local firewall rules)... the router is only needed to deal with traffic between the LAN and another network, such as another LAN or the Internet...

it should be set to DROP...having the policy set to DROP, then you only need to add rules for the packets you actually want to ACCEPT... anything that doesn't get ACCEPTed will hit the default policy of DROP...

so should my configuration look like this?

I asked my teacher about the connection between the computers and this is what he said:

"This talks about the firewall on the router. In your case, the firewall
is on the end server, for example, IPtables, which manages every packet
in or out the server. This kind of firewall still works even when
attackers are in the same LAN."

What kind of packets do I need to accept? Thanks for all of the help by the way

yup, your teacher is right... but this was stated here before, in post #23:

what packets do I need to let through and do i need give them any specific permissions?

if it's strictly an HTTP server then basically you just need to allow TCP packets destined to port 80... if it's also HTTPS then add a rule for TCP port 443... sorry i can't be more specific right now, i'm kinda in the middle of something... i'm sure someone else will jump in...

If I wanted to accept the address 192.168.1.20, how would I write the rule? Also, if I write this at the very top of my rules, would it be executed first?

Also, if I wanted to block all ip addresses other than the 192.168.1.20 address (192.168.1.1-19,21-255) how would I write that rule?

Thanks in advance

AFAIK you can specify a mask in iptables,
say
this will solve your problem of giving a range/same address 255 times!