Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the attack was going on the WAN port was downloading at 30Mbit/sec. The uplink on the firewall is 1Gbit and the attack didn't affect anything else on the network.

Blocking the attacker's IP address on the firewall didn't do anything.

I did a SYN flooding test myself and it shows that the firewall is very sensitive to SYN flooding. I have all content scanning services disabled because they cause high CPU load so I'm only using the firewall service.

I have contacted ZyXel and they responded that there was nothing I could do except wait for the attacker to give up. That is unacceptable because apparently anyone with a decent network connection is able to bring it down.

Is this normal and common issue in low-end firewalls? Is there anything I can do to prevent this?

share|improve this question

5 Answers 5

The physical interface may be 1Gbps but that doesn't necessarily mean the hardware itself can process that much. Looking at the specs on your device I see a few items that may be of particular interest for you.

  • SPI Firewall Throughput: 250 Mbps
  • UTM Throughput (AV+IDP): 40 Mbps
  • Max Sessions: 40,000

What that's telling us is that no matter what your uplink throughput is the most traffic your device will ever pass is 250 Mbps. This is probably not a hard limit, in that you may be able to sneak a little higher, but it's all the manufacturer will guarantee. The limitation is most likely hardware, probably the IO backplane but possibly CPU.

As you enable additional features this throughput will only drop, we can see that if you enable Anti-Virus and Intrusion Detection and Prevention you're only rated for 40 Mbps. This is most certainly related to processor and is pretty dang close to what you say you were seeing at your peak.

Another hard limit is your max session count. This is the number of total open connections your device can handle. Generally, once this limit is reached, any new connections will simply be denied. This is usually a limitation of memory, since the connection tracking table is stored in memory.

In any event you really need to understand the full impact of running the services and what your device is capable of. This is really the only way to know what happens in situations like this.

share|improve this answer
    
I have AV and IDP disabled and the firewall has been able to handle up to 100Mbit/sec. I have configured the session limit of 4000 sessions per host. That's my concern, a single user with a decent network connection (30Mbit/sec) is able to cripple the firewall. –  sarge Sep 14 '13 at 10:28

If your firewall is tracking a new connection for every incoming SYN packet, then this is what you would expect. In fact, it's exactly the point of a SYN flood attack.

If your firewall is stateless (no connection tracking) then you wouldn't expect any pronounced effect from SYN floods, since SYN packets are treated no different from any other.

share|improve this answer

If you have a router in front of your firewall, configure the router to drop the packets originating for the IP address. Your router should be better equipped (I hope....) to deal with that level of network activity compared to the firewall.

share|improve this answer
    
That's what I did eventually, drop the packets before it reached the firewall. However I don't want this to be frequent issue so I would rather like to find a way so that the firewall can handle "small" attacks like this. –  sarge Sep 14 '13 at 10:30

I have worked on hardware firewalls and we had something called Syn-cookie.The firewall does not create a complete connection after receiving just the Syn packet.It sends the syn-ack and waits for the ack before creating a connection.

Syn cookie wiki page

Please check if this firewall has this feature.I did a quick search but could not find any articles.

There are other ways to handle this.One method is similar to what Terry has mentioned in a post above,to block the packets from that machine with an IP filtering device or setting up source routing (if that feature is present on your device) to send all packets from the troublesome IP to a null interface.

Most firewalls have rate limiting features.That is if the number of connections per second from a single source-ip exceeds a particular limit, then start dropping connections from that source-ip for a period of time

Another point (mentioned by Scott) is regarding the session processing engine.I understand that this device is a stateful firewall.Sometimes i see that the stateful inspection feature is turned off on some devices.(it is a security threat and it can also lead to sessions overshooting on the device and could lead to higher CPU utilization)

Yet another way to stop problems is a session table entry with a deny action.So each packet being send by the malicious IP is triggering a policy lookup and being denied.Policy lookups can be CPU intensive.Some firewalls have this feature by which, if a packet gets denied by a policy, a session table entry is created for that packet caching the deny action so that the next packet from the same IP does not get to the policy/routing stage at all and gets dropped at the session lookup stage itself.

All the things mentioned are general ways that firewalls might use to prevent against these attacks.You will have to look into the documentation of your firewall to see if any of these techniques are possible.

share|improve this answer
    
I have done some research and it looks like ZyWall doesn't support Syn cookie and it is stateful. It's also configured to not allow more than 4000 session per host (but that doesn't seem to help in attacks like this). If these are the only ways to fight SYN attacks I may not be able to avoid such attacks. –  sarge Sep 14 '13 at 10:52
    
What about setting up a source route with the IP address pointing to null interface or turning on deny sessions for the policy ? –  aRun Sep 14 '13 at 13:05

It's possible to limit every syn that doesn't have answer. for example, the following article can start point to configure your firewall for avoid for syn flood:

Linux Iptables Limit the number of incoming tcp connection / syn-flood attacks

share|improve this answer
    
you realise the OP has a ZyWall, right? –  Rory Alsop Sep 16 '13 at 13:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.