Re: [Efw-user] syn-flood prevention?

2015-02-12 Thread Josh Carter
Looks promising. As a pure firewall it should do well, will have to keep an eye 
on the development of some of the UTM features due later this year. (Squid, 
IPS, etc)


From: Matt Hayes [mailto:domin...@slackadelic.com]
Sent: Thursday, 12 February 2015 3:26 AM
To: efw-user@lists.sourceforge.net
Subject: Re: [Efw-user] syn-flood prevention?

I've been testing opnsense (opnsense.orghttp://opnsense.org) a pfsense fork.. 
really like it.

On Wed, Feb 11, 2015 at 11:10 AM, Jason 
phibro...@gmail.commailto:phibro...@gmail.com wrote:
I've heard pfSense was a good Alternative to Endian... as I still run
this for my school/church.
I am looking for alteratives as well... I also run a UBNT EdgeRouter
Lite (which like he said below - is based on Juniper / Barocade CLI...
(its not Cisco or HP CLI...) and with the latest firmware update - there
is a bunch that you can do now from the GUI on the last tab is is in
a tree format.

Jason
On 2/11/15 3:18 AM, Andre Mueller wrote:
 Yes I can recommend Ubiquiti's EdgeRouters as hardware based
 alternative. I deployed serveral units of EdgeRouter lite and also some
 EdgeRouter Pro. The GUI does not allow to configure all details, but
 this can be accomplished with the CLI, which is very intuitive. The OS
 is based on the opensource OS of Vyatta (now part of Brocade).
 Unfortunately the free version offered by Brocade is missing a GUI.

 For our own purposes I will try the free version of Sophos, in order to
 replace our virtualized Endian firewall and router.

 best regards,




 Am 10.02.2015 um 14:31 schrieb AJ Weber:
 I was a long-time user of EFW and liked the product, but I'm not telling
 you anything you don't already know when I say that they've completely
 ignored the distro and there's virtually no development or support any
 longer.

 Someone here mentioned Ubiquiti's EdgeRouters a while back, so I bought
 an EdgeRouter Lite.  It has been very stable, fast and secure.  It
 doesn't have all of the appliance features, because it's designed as a
 router/fw first.  But you can add debian packages to tweak it --
 provided you keep in mind that it has finite cpu and memory.

 Would be nice if their OS was ready to run on any intel-based box, but
 their prices are more-than-fair for the hardware.  And their forums are
 very responsive from other users AND the developers.

 In my case, I replaced a EFW PC and a load-balancer with the one
 EdgeRouter Lite for way-lower electric consumption and faster throughput.

 --
 Dive into the World of Parallel Programming. The Go Parallel Website,
 sponsored by Intel and developed in partnership with Slashdot Media, is your
 hub for all things parallel software development, from weekly thought
 leadership blogs to news, videos, case studies, tutorials and more. Take a
 look and join the conversation now. http://goparallel.sourceforge.net/
 ___
 Efw-user mailing list
 Efw-user@lists.sourceforge.netmailto:Efw-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/efw-user

--
The unauthorized disclosure or interception of e-mail is a federal crime. See 
18 U.S.C. Sec. 2517(4). This message is confidential and intended for the 
identified recipient only.  It may contain privileged or confidential 
information. This e-mail and any files transmitted with it are the property of 
the sender, are confidential and may be privileged, and are intended solely for 
the use of the individuals or parties to whom this e-mail is addressed. If you 
are not one of the named recipients or have received this message in error, 
please notify the sender immediately and delete this message. You are also 
hereby notified that any unauthorized dissemination, distribution, or copying 
of this information is strictly prohibited. The sender shall not be liable for 
any unauthorized use of, or inaccuracies resulting from additions to or 
deletions from, information originally contained in this transmission



--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.netmailto:Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user

 Charter Hall 
This e-mail message and any accompanying attachments may contain information 
that is confidential and subject to legal privilege.  If you are not the 
intended recipient, do not read, use, disseminate, distribute or copy this 
message or attachments

Re: [Efw-user] syn-flood prevention?

2015-02-11 Thread Matt Hayes
I've been testing opnsense (opnsense.org) a pfsense fork.. really like it.

On Wed, Feb 11, 2015 at 11:10 AM, Jason phibro...@gmail.com wrote:

 I've heard pfSense was a good Alternative to Endian... as I still run
 this for my school/church.
 I am looking for alteratives as well... I also run a UBNT EdgeRouter
 Lite (which like he said below - is based on Juniper / Barocade CLI...
 (its not Cisco or HP CLI...) and with the latest firmware update - there
 is a bunch that you can do now from the GUI on the last tab is is in
 a tree format.

 Jason
 On 2/11/15 3:18 AM, Andre Mueller wrote:
  Yes I can recommend Ubiquiti's EdgeRouters as hardware based
  alternative. I deployed serveral units of EdgeRouter lite and also some
  EdgeRouter Pro. The GUI does not allow to configure all details, but
  this can be accomplished with the CLI, which is very intuitive. The OS
  is based on the opensource OS of Vyatta (now part of Brocade).
  Unfortunately the free version offered by Brocade is missing a GUI.
 
  For our own purposes I will try the free version of Sophos, in order to
  replace our virtualized Endian firewall and router.
 
  best regards,
 
 
 
 
  Am 10.02.2015 um 14:31 schrieb AJ Weber:
  I was a long-time user of EFW and liked the product, but I'm not telling
  you anything you don't already know when I say that they've completely
  ignored the distro and there's virtually no development or support any
  longer.
 
  Someone here mentioned Ubiquiti's EdgeRouters a while back, so I bought
  an EdgeRouter Lite.  It has been very stable, fast and secure.  It
  doesn't have all of the appliance features, because it's designed as a
  router/fw first.  But you can add debian packages to tweak it --
  provided you keep in mind that it has finite cpu and memory.
 
  Would be nice if their OS was ready to run on any intel-based box, but
  their prices are more-than-fair for the hardware.  And their forums are
  very responsive from other users AND the developers.
 
  In my case, I replaced a EFW PC and a load-balancer with the one
  EdgeRouter Lite for way-lower electric consumption and faster
 throughput.
 
 
 --
  Dive into the World of Parallel Programming. The Go Parallel Website,
  sponsored by Intel and developed in partnership with Slashdot Media, is
 your
  hub for all things parallel software development, from weekly thought
  leadership blogs to news, videos, case studies, tutorials and more. Take
 a
  look and join the conversation now. http://goparallel.sourceforge.net/
  ___
  Efw-user mailing list
  Efw-user@lists.sourceforge.net
  https://lists.sourceforge.net/lists/listinfo/efw-user

 --
 The unauthorized disclosure or interception of e-mail is a federal crime.
 See 18 U.S.C. Sec. 2517(4). This message is confidential and intended for
 the identified recipient only.  It may contain privileged or confidential
 information. This e-mail and any files transmitted with it are the property
 of the sender, are confidential and may be privileged, and are intended
 solely for the use of the individuals or parties to whom this e-mail is
 addressed. If you are not one of the named recipients or have received this
 message in error, please notify the sender immediately and delete this
 message. You are also hereby notified that any unauthorized dissemination,
 distribution, or copying of this information is strictly prohibited. The
 sender shall not be liable for any unauthorized use of, or inaccuracies
 resulting from additions to or deletions from, information originally
 contained in this transmission




 --
 Dive into the World of Parallel Programming. The Go Parallel Website,
 sponsored by Intel and developed in partnership with Slashdot Media, is
 your
 hub for all things parallel software development, from weekly thought
 leadership blogs to news, videos, case studies, tutorials and more. Take a
 look and join the conversation now. http://goparallel.sourceforge.net/
 ___
 Efw-user mailing list
 Efw-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/efw-user

--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-11 Thread Jason
I've heard pfSense was a good Alternative to Endian... as I still run 
this for my school/church.
I am looking for alteratives as well... I also run a UBNT EdgeRouter 
Lite (which like he said below - is based on Juniper / Barocade CLI... 
(its not Cisco or HP CLI...) and with the latest firmware update - there 
is a bunch that you can do now from the GUI on the last tab is is in 
a tree format.

Jason
On 2/11/15 3:18 AM, Andre Mueller wrote:
 Yes I can recommend Ubiquiti's EdgeRouters as hardware based
 alternative. I deployed serveral units of EdgeRouter lite and also some
 EdgeRouter Pro. The GUI does not allow to configure all details, but
 this can be accomplished with the CLI, which is very intuitive. The OS
 is based on the opensource OS of Vyatta (now part of Brocade).
 Unfortunately the free version offered by Brocade is missing a GUI.

 For our own purposes I will try the free version of Sophos, in order to
 replace our virtualized Endian firewall and router.

 best regards,




 Am 10.02.2015 um 14:31 schrieb AJ Weber:
 I was a long-time user of EFW and liked the product, but I'm not telling
 you anything you don't already know when I say that they've completely
 ignored the distro and there's virtually no development or support any
 longer.

 Someone here mentioned Ubiquiti's EdgeRouters a while back, so I bought
 an EdgeRouter Lite.  It has been very stable, fast and secure.  It
 doesn't have all of the appliance features, because it's designed as a
 router/fw first.  But you can add debian packages to tweak it --
 provided you keep in mind that it has finite cpu and memory.

 Would be nice if their OS was ready to run on any intel-based box, but
 their prices are more-than-fair for the hardware.  And their forums are
 very responsive from other users AND the developers.

 In my case, I replaced a EFW PC and a load-balancer with the one
 EdgeRouter Lite for way-lower electric consumption and faster throughput.

 --
 Dive into the World of Parallel Programming. The Go Parallel Website,
 sponsored by Intel and developed in partnership with Slashdot Media, is your
 hub for all things parallel software development, from weekly thought
 leadership blogs to news, videos, case studies, tutorials and more. Take a
 look and join the conversation now. http://goparallel.sourceforge.net/
 ___
 Efw-user mailing list
 Efw-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/efw-user

-- 
The unauthorized disclosure or interception of e-mail is a federal crime. See 
18 U.S.C. Sec. 2517(4). This message is confidential and intended for the 
identified recipient only.  It may contain privileged or confidential 
information. This e-mail and any files transmitted with it are the property of 
the sender, are confidential and may be privileged, and are intended solely for 
the use of the individuals or parties to whom this e-mail is addressed. If you 
are not one of the named recipients or have received this message in error, 
please notify the sender immediately and delete this message. You are also 
hereby notified that any unauthorized dissemination, distribution, or copying 
of this information is strictly prohibited. The sender shall not be liable for 
any unauthorized use of, or inaccuracies resulting from additions to or 
deletions from, information originally contained in this transmission



--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-11 Thread Andre Mueller

Yes I can recommend Ubiquiti's EdgeRouters as hardware based 
alternative. I deployed serveral units of EdgeRouter lite and also some 
EdgeRouter Pro. The GUI does not allow to configure all details, but 
this can be accomplished with the CLI, which is very intuitive. The OS 
is based on the opensource OS of Vyatta (now part of Brocade). 
Unfortunately the free version offered by Brocade is missing a GUI.

For our own purposes I will try the free version of Sophos, in order to 
replace our virtualized Endian firewall and router.

best regards,




Am 10.02.2015 um 14:31 schrieb AJ Weber:
 I was a long-time user of EFW and liked the product, but I'm not telling
 you anything you don't already know when I say that they've completely
 ignored the distro and there's virtually no development or support any
 longer.

 Someone here mentioned Ubiquiti's EdgeRouters a while back, so I bought
 an EdgeRouter Lite.  It has been very stable, fast and secure.  It
 doesn't have all of the appliance features, because it's designed as a
 router/fw first.  But you can add debian packages to tweak it --
 provided you keep in mind that it has finite cpu and memory.

 Would be nice if their OS was ready to run on any intel-based box, but
 their prices are more-than-fair for the hardware.  And their forums are
 very responsive from other users AND the developers.

 In my case, I replaced a EFW PC and a load-balancer with the one
 EdgeRouter Lite for way-lower electric consumption and faster throughput.


--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-10 Thread Josh Carter
+1.

Moved from Endian ~12 months ago now.

I’ve found ipfire to be close to like for like replacement, with an appropriate 
level of community and developer support available when needed.

Just my 2c.

--JC


From: Matt Hayes [mailto:domin...@slackadelic.com]
Sent: Tuesday, 10 February 2015 3:02 AM
To: efw-user@lists.sourceforge.net
Subject: Re: [Efw-user] syn-flood prevention?

I'm only responding as most likely you will not get a response from Endian 
themselves, I'm not sure why it is not working if you have syn flood protection 
enabled already.  I myself am slowly moving from Endian Firewall Community as 
I'm not able to get any answers from Endian or their developers at all.
There are numerous security issues with the distribution specifically with SSH 
and openssl.  I'm moving to a more up to date and maintained firewall for my 
needs.

Good luck.

On Mon, Feb 9, 2015 at 9:41 AM, Andre Mueller 
andre.muel...@himmel-blau.commailto:andre.muel...@himmel-blau.com wrote:

Endian 3.0.devel : Community Version

Hello

I have the problem that our Endian installation configured as a router
(public subnet on the orange zone) is attacked on the routers
WAN-interface (Red uplink) by massive syn-flood requests.

As we have checked on our Endian syn_cookies are activated, so the first
perquisite for protection against syn-flood attacks is active. But the
problem is that our router does respond to every syn-flood request
(SYN_SENT) and by doing so it saturates our WAN-/upload-Line.

Is there any possibility that we can prevent our router to send out any
SYN-packet, whenever a certain amount of not acknowledged SYN-packets
have sent out to the very same IP-destination (but on different ports)?


I would be grateful for any hint. Thanks in advance, Andre



--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.netmailto:Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user

 Charter Hall 
This e-mail message and any accompanying attachments may contain information 
that is confidential and subject to legal privilege.  If you are not the 
intended recipient, do not read, use, disseminate, distribute or copy this 
message or attachments.  If you have received this message in error, please 
advise Charter Hall by return e-mail or telephone (02) 8651 9000.  Any views 
expressed in this message are those of the individual sender, except where the 
sender expressly and with authority states them to be the views of Charter 
Hall.  Charter Hall cannot guarantee that this e-mail or any attachments are 
free of viruses or other conditions which may damage or interfere with data, 
hardware or software with which it might be used.
==
--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-10 Thread Andre Mueller

Hello Matt

Thank you very much for your answer.

This night I found, that our router was not afflicted by an syn-flood 
attack, but was hacked and was used as an syn-flood server itself. There 
was no way to save it, as the bad files where distributed over the 
system and reloaded themself permanently and so I had to set-up the 
router from fresh.

Yes your are right about the future development of the community version 
and it is wise to move to an other firewall.

best regards


Am 09.02.2015 um 17:02 schrieb Matt Hayes:
 I'm only responding as most likely you will not get a response from
 Endian themselves, I'm not sure why it is not working if you have syn
 flood protection enabled already.  I myself am slowly moving from Endian
 Firewall Community as I'm not able to get any answers from Endian or
 their developers at all.

 There are numerous security issues with the distribution specifically
 with SSH and openssl.  I'm moving to a more up to date and maintained
 firewall for my needs.

 Good luck.



--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-10 Thread AJ Weber
I was a long-time user of EFW and liked the product, but I'm not telling 
you anything you don't already know when I say that they've completely 
ignored the distro and there's virtually no development or support any 
longer.

Someone here mentioned Ubiquiti's EdgeRouters a while back, so I bought 
an EdgeRouter Lite.  It has been very stable, fast and secure.  It 
doesn't have all of the appliance features, because it's designed as a 
router/fw first.  But you can add debian packages to tweak it -- 
provided you keep in mind that it has finite cpu and memory.

Would be nice if their OS was ready to run on any intel-based box, but 
their prices are more-than-fair for the hardware.  And their forums are 
very responsive from other users AND the developers.

In my case, I replaced a EFW PC and a load-balancer with the one 
EdgeRouter Lite for way-lower electric consumption and faster throughput.

On 2/10/2015 3:35 AM, Andre Mueller wrote:
 Hello Matt

 Thank you very much for your answer.

 This night I found, that our router was not afflicted by an syn-flood
 attack, but was hacked and was used as an syn-flood server itself. There
 was no way to save it, as the bad files where distributed over the
 system and reloaded themself permanently and so I had to set-up the
 router from fresh.

 Yes your are right about the future development of the community version
 and it is wise to move to an other firewall.

 best regards


 Am 09.02.2015 um 17:02 schrieb Matt Hayes:
 I'm only responding as most likely you will not get a response from
 Endian themselves, I'm not sure why it is not working if you have syn
 flood protection enabled already.  I myself am slowly moving from Endian
 Firewall Community as I'm not able to get any answers from Endian or
 their developers at all.

 There are numerous security issues with the distribution specifically
 with SSH and openssl.  I'm moving to a more up to date and maintained
 firewall for my needs.

 Good luck.


 --
 Dive into the World of Parallel Programming. The Go Parallel Website,
 sponsored by Intel and developed in partnership with Slashdot Media, is your
 hub for all things parallel software development, from weekly thought
 leadership blogs to news, videos, case studies, tutorials and more. Take a
 look and join the conversation now. http://goparallel.sourceforge.net/
 ___
 Efw-user mailing list
 Efw-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/efw-user


--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-10 Thread Matt Hayes
I'm testing opnsense right now, really like it.  Fork of pfsense.

On Tue, Feb 10, 2015 at 8:31 AM, AJ Weber awe...@comcast.net wrote:

 I was a long-time user of EFW and liked the product, but I'm not telling
 you anything you don't already know when I say that they've completely
 ignored the distro and there's virtually no development or support any
 longer.

 Someone here mentioned Ubiquiti's EdgeRouters a while back, so I bought
 an EdgeRouter Lite.  It has been very stable, fast and secure.  It
 doesn't have all of the appliance features, because it's designed as a
 router/fw first.  But you can add debian packages to tweak it --
 provided you keep in mind that it has finite cpu and memory.

 Would be nice if their OS was ready to run on any intel-based box, but
 their prices are more-than-fair for the hardware.  And their forums are
 very responsive from other users AND the developers.

 In my case, I replaced a EFW PC and a load-balancer with the one
 EdgeRouter Lite for way-lower electric consumption and faster throughput.

 On 2/10/2015 3:35 AM, Andre Mueller wrote:
  Hello Matt
 
  Thank you very much for your answer.
 
  This night I found, that our router was not afflicted by an syn-flood
  attack, but was hacked and was used as an syn-flood server itself. There
  was no way to save it, as the bad files where distributed over the
  system and reloaded themself permanently and so I had to set-up the
  router from fresh.
 
  Yes your are right about the future development of the community version
  and it is wise to move to an other firewall.
 
  best regards
 
 
  Am 09.02.2015 um 17:02 schrieb Matt Hayes:
  I'm only responding as most likely you will not get a response from
  Endian themselves, I'm not sure why it is not working if you have syn
  flood protection enabled already.  I myself am slowly moving from Endian
  Firewall Community as I'm not able to get any answers from Endian or
  their developers at all.
 
  There are numerous security issues with the distribution specifically
  with SSH and openssl.  I'm moving to a more up to date and maintained
  firewall for my needs.
 
  Good luck.
 
 
 
 --
  Dive into the World of Parallel Programming. The Go Parallel Website,
  sponsored by Intel and developed in partnership with Slashdot Media, is
 your
  hub for all things parallel software development, from weekly thought
  leadership blogs to news, videos, case studies, tutorials and more. Take
 a
  look and join the conversation now. http://goparallel.sourceforge.net/
  ___
  Efw-user mailing list
  Efw-user@lists.sourceforge.net
  https://lists.sourceforge.net/lists/listinfo/efw-user



 --
 Dive into the World of Parallel Programming. The Go Parallel Website,
 sponsored by Intel and developed in partnership with Slashdot Media, is
 your
 hub for all things parallel software development, from weekly thought
 leadership blogs to news, videos, case studies, tutorials and more. Take a
 look and join the conversation now. http://goparallel.sourceforge.net/
 ___
 Efw-user mailing list
 Efw-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/efw-user

--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


Re: [Efw-user] syn-flood prevention?

2015-02-09 Thread Matt Hayes
I'm only responding as most likely you will not get a response from Endian
themselves, I'm not sure why it is not working if you have syn flood
protection enabled already.  I myself am slowly moving from Endian Firewall
Community as I'm not able to get any answers from Endian or their
developers at all.

There are numerous security issues with the distribution specifically with
SSH and openssl.  I'm moving to a more up to date and maintained firewall
for my needs.

Good luck.

On Mon, Feb 9, 2015 at 9:41 AM, Andre Mueller andre.muel...@himmel-blau.com
 wrote:


 Endian 3.0.devel : Community Version

 Hello

 I have the problem that our Endian installation configured as a router
 (public subnet on the orange zone) is attacked on the routers
 WAN-interface (Red uplink) by massive syn-flood requests.

 As we have checked on our Endian syn_cookies are activated, so the first
 perquisite for protection against syn-flood attacks is active. But the
 problem is that our router does respond to every syn-flood request
 (SYN_SENT) and by doing so it saturates our WAN-/upload-Line.

 Is there any possibility that we can prevent our router to send out any
 SYN-packet, whenever a certain amount of not acknowledged SYN-packets
 have sent out to the very same IP-destination (but on different ports)?


 I would be grateful for any hint. Thanks in advance, Andre




 --
 Dive into the World of Parallel Programming. The Go Parallel Website,
 sponsored by Intel and developed in partnership with Slashdot Media, is
 your
 hub for all things parallel software development, from weekly thought
 leadership blogs to news, videos, case studies, tutorials and more. Take a
 look and join the conversation now. http://goparallel.sourceforge.net/
 ___
 Efw-user mailing list
 Efw-user@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/efw-user

--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user


[Efw-user] syn-flood prevention?

2015-02-09 Thread Andre Mueller

Endian 3.0.devel : Community Version

Hello

I have the problem that our Endian installation configured as a router 
(public subnet on the orange zone) is attacked on the routers 
WAN-interface (Red uplink) by massive syn-flood requests.

As we have checked on our Endian syn_cookies are activated, so the first 
perquisite for protection against syn-flood attacks is active. But the 
problem is that our router does respond to every syn-flood request 
(SYN_SENT) and by doing so it saturates our WAN-/upload-Line.

Is there any possibility that we can prevent our router to send out any 
SYN-packet, whenever a certain amount of not acknowledged SYN-packets 
have sent out to the very same IP-destination (but on different ports)?


I would be grateful for any hint. Thanks in advance, Andre



--
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
___
Efw-user mailing list
Efw-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/efw-user