SYN flooding attack causing high CPU on hardware firewall

Question

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the attack was going on the WAN port was downloading at 30Mbit/sec. The uplink on the firewall is 1Gbit and the attack didn't affect anything else on the network.

Blocking the attacker's IP address on the firewall didn't do anything.

I did a SYN flooding test myself and it shows that the firewall is very sensitive to SYN flooding. I have all content scanning services disabled because they cause high CPU load so I'm only using the firewall service.

I have contacted ZyXel and they responded that there was nothing I could do except wait for the attacker to give up. That is unacceptable because apparently anyone with a decent network connection is able to bring it down.

Is this normal and common issue in low-end firewalls? Is there anything I can do to prevent this?

Answer 1

If you have a router in front of your firewall, configure the router to drop the packets originating for the IP address. Your router should be better equipped (I hope....) to deal with that level of network activity compared to the firewall.

Answer 2

If your firewall is tracking a new connection for every incoming SYN packet, then this is what you would expect. In fact, it's exactly the point of a SYN flood attack.

If your firewall is stateless (no connection tracking) then you wouldn't expect any pronounced effect from SYN floods, since SYN packets are treated no different from any other.

Answer 3

The physical interface may be 1Gbps but that doesn't necessarily mean the hardware itself can process that much. Looking at the specs on your device I see a few items that may be of particular interest for you.

• SPI Firewall Throughput: 250 Mbps
• UTM Throughput (AV+IDP): 40 Mbps
• Max Sessions: 40,000

What that's telling us is that no matter what your uplink throughput is the most traffic your device will ever pass is 250 Mbps. This is probably not a hard limit, in that you may be able to sneak a little higher, but it's all the manufacturer will guarantee. The limitation is most likely hardware, probably the IO backplane but possibly CPU.

As you enable additional features this throughput will only drop, we can see that if you enable Anti-Virus and Intrusion Detection and Prevention you're only rated for 40 Mbps. This is most certainly related to processor and is pretty dang close to what you say you were seeing at your peak.

Another hard limit is your max session count. This is the number of total open connections your device can handle. Generally, once this limit is reached, any new connections will simply be denied. This is usually a limitation of memory, since the connection tracking table is stored in memory.

In any event you really need to understand the full impact of running the services and what your device is capable of. This is really the only way to know what happens in situations like this.

Answer 4

I have worked on hardware firewalls and we had something called Syn-cookie.The firewall does not create a complete connection after receiving just the Syn packet.It sends the syn-ack and waits for the ack before creating a connection.

Syn cookie wiki page

Please check if this firewall has this feature.I did a quick search but could not find any articles.

There are other ways to handle this.One method is similar to what Terry has mentioned in a post above,to block the packets from that machine with an IP filtering device or setting up source routing (if that feature is present on your device) to send all packets from the troublesome IP to a null interface.

Most firewalls have rate limiting features.That is if the number of connections per second from a single source-ip exceeds a particular limit, then start dropping connections from that source-ip for a period of time

Another point (mentioned by Scott) is regarding the session processing engine.I understand that this device is a stateful firewall.Sometimes i see that the stateful inspection feature is turned off on some devices.(it is a security threat and it can also lead to sessions overshooting on the device and could lead to higher CPU utilization)

Yet another way to stop problems is a session table entry with a deny action.So each packet being send by the malicious IP is triggering a policy lookup and being denied.Policy lookups can be CPU intensive.Some firewalls have this feature by which, if a packet gets denied by a policy, a session table entry is created for that packet caching the deny action so that the next packet from the same IP does not get to the policy/routing stage at all and gets dropped at the session lookup stage itself.

All the things mentioned are general ways that firewalls might use to prevent against these attacks.You will have to look into the documentation of your firewall to see if any of these techniques are possible.

Answer 5

It's possible to limit every syn that doesn't have answer. for example, the following article can start point to configure your firewall for avoid for syn flood:

Linux Iptables Limit the number of incoming tcp connection / syn-flood attacks