3

My Question is that if a Firewall blocks for example a DOS attack of UDP packets. Is it then possible to "break" or take up the capacity of a server by sending enough packets trough a DDOS attack? or does the firewall sort and redirect the packets to a dump where the packets does not take up any processing power?

I asked my teacher and he said that in theory it is possible to "overload" a firewall by sending enough of one type of packet(if we limit ourself to that). But it does not seem like it, at least with a classroom worth of processing power spamming a firewall in one PC.

2

Some firewalls have the option to bypass inspection on high load, i.e. Checkpoint has the option "To bypass IPS inspection under heavy load". Which means if this options is set you could weaken the security using some kind of DOS attack (not necessarily all kind of DOS) which ultimately could lead to security problems.

If no such options is set most firewalls will just slow down and impact traffic this way. This by itself does not directly affect the security but it might be used to hide the real attack in all the log data or to divert the attention from the administrators to the DOS and away from other attacks.

  • But does this mean that a Firewall is unbreakable? Lets say that if you dont set the option to bypass IPS inspection under heavy load but let the firewall take all the packets and check all of them. will this lead to the firewall taking up so much processing power to check the packets that the application which the firewall protects wont have the needed processing power? Or can the firewall process be crashed by overload? – John David Mar 15 '16 at 8:39
  • 1
    @JohnDavid - are you talking about a hardware firewall or a software one? – Neil Smithline Mar 15 '16 at 15:33
  • @Niel Smithline - I was thinking about software types primarily. sorry if it caused any confusion. – John David Apr 5 '16 at 6:22
  • @JohnDavid: I'm sure that you can build a software firewall which crashes on DoS and has a fail open and thus can be bypassed with high load. And given the 100s of different firewalls out there they might even be one which fails like this. But it would not be a good one and most firewalls would not fail open. – Steffen Ullrich Apr 5 '16 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.