Re: DoS Horror Story - Or - Please Recommend a Firewall for Win2k3

On Jul 28, 2005, at 2:45 PM, AFW wrote:

> -Proxy: I'm familiar with proxys from the client side view. The  
> proxy caches
> web content and makes it faster, plus if you surf to web pages it  
> will show
> only the proxy computer as visitor. But I'm not sure how it will  
> help me in
> protecting the server.

A reverse proxy will help "normalize" your traffic.

> - Configurable IP/TCP/UDP values. Are these values timeout values ? or
> min-max values? It sounds like it would help me right now, but I'm  
> not sure.
> I receive many malformed http packets and all kinds of icmp or  
> incomplete
> packets. My current firewall has an option to "tarpit" connections.  
> That is
> to accept connections but not honor disconnections. But when  
> attacked by
> many (spoofed) ips, I'm not sure how much it helps?

By modifying the timeouts you can limit the amount of states, frags,  
open/listening connections, etc., freeing up needed resources during  
a DoS attack.

> - I have searched and read to learn more about IP defragmentation  
> and QoS.
> Thank you :)

No problem.

> I have forwarded these requirements also to my current firewall vendor
> (Visnetic).

If you trust your firewall vendor so much, why didn't you ask them in  
the first place?  I'm sure they'd be happy to sell you the perfect  
solution.  ;-)

--
Jason Dixon
DixonGroup Consulting
http://www.dixongroup.net