How to secure server from SYN flooding and DoS attack

As the internet is becoming larger day by day, therefore security risks for your servers are also increasing. If your server is connected to internet and is hosting some good high traffic and popular websites, then there are high chances that you get SYN flooding. SYN flooding is a kind of DOS attack, a.k.a “Deniel of service” attack.

SYN

SYN packet are specific packes used to establish tcp connection, a packet which send a message to host, something like “Hello, is there anyone on this port?”
If a server is alive, it will give response, “yes, a service is listening”
Now the final step ACK packet, sent back to service and tell “OK, lets begin our talk”

And it start the exchange of information betweek client and server.

SYN flooding

SYN flooding is kind of DOS, which contains large amount of SYN packets, until the capacity of server gets full and it may become not able to receive any more packets.
The basic purpose of SYN flood is to send as large amount of SYN requests, that they consume all the capacity of server and the server may not establish any more connections and give “timed out” error.

Be aware, that there is no way to discard such kind of attacks, but THERE are ways to reduce the impact of such attacks.

Edit /etc/sysctl.conf

nano /etc/sysctl.conf

1	nano /etc/sysctl.conf

and add

#securing tcp connections
net.ipv4.tcp_syncookies=1
#reducing timed out to 30
net.netfilter.nf_conntrack_tcp_timeout_syn_recv=30

#securing tcp connections

net.ipv4.tcp_syncookies=1

#reducing timed out to 30

net.netfilter.nf_conntrack_tcp_timeout_syn_recv=30

Edit iptables firewall

# create new chains
iptables -N syn-flood

# limits incoming packets
iptables -A syn-flood -m limit --limit 10/second --limit-burst 50 -j RETURN

# log attacks
iptables -A syn-flood -j LOG --log-prefix "SYN flood: "

# silently drop the rest
iptables -A syn-flood -j DROP

# create new chains

iptables -N syn-flood

# limits incoming packets

iptables -A syn-flood -m limit --limit 10/second --limit-burst 50 -j RETURN

# log attacks

iptables -A syn-flood -j LOG --log-prefix "SYN flood: "

# silently drop the rest

iptables -A syn-flood -j DROP

You can run those iptables rules in your server one by one, or just download file from here, chmod it to 755 and just run it.

[root@mailserver1 ~]# wget http://www.techat.net/wp-content/myuploads/2010/12/fw-synflood.txt
[root@mailserver1 ~]# mv fw-synflood.txt fw-synflood
[root@mailserver1 ~]#chmod 755 fw-synflood
[root@mailserver1 ~]#./fw-synflood