switch OFF syn cookies

Posted by Nick on Server Fault See other posts from Server Fault or by Nick
Published on 2012-10-12T09:19:01Z Indexed on 2012/10/12 9:39 UTC
Read the original article Hit count: 218

Filed under:

iptables

|

ip

|

tcpip

We have several servers they have public IP's, but work together (one is with Load Balancer, orther with Apache Web server, other with MySQL and so on.

Most of the ports are fire-walled, so only "local" servers can be connect there. However ALL servers have some ports that must be publicly open.

We have SYN Cookies enabled and from time to time we got:

possible SYN flooding on port 8080. Sending cookies.

Port 8080 is not public. How we can switch OFF SYN Cookies for some ports (e.g. 8080, 3306 etc) or from some sources (e.g. our servers),

but in same time SYN Cookies to be switched ON for all other ports, e.g. port 80.

We found this similar problem, except our servers are with public IP's: SYN cookies on internal machines

© Server Fault or respective owner

Related posts about iptables

Sometimes this script fails to update the iptables

as seen on Server Fault - Search for 'Server Fault'
It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The iptables is structured as look-up tree (long repeated sections snipped): #!/bin/sh iptables -t… >>> More
My current iptable configuration doesn't work [on hold]

as seen on Server Fault - Search for 'Server Fault'
sudo chkconfig iptables off /etc/init.d/iptables on ### Clear/flush iptables sudo iptables -F sudo iptables -P INPUT ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -P FORWARD ACCEPT ### Allow SSH iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables… >>> More
L2TP iptables port forward

as seen on Server Fault - Search for 'Server Fault'
Hi all, I'm setting up port forwarding for an L2TP VPN connection to the local Windows 2003 VPN server. The router is a simpel Debian machine with iptables. The VPN server works perfect. But I cannot log in from the WAN. I'm missing something. The VPN server is using a pre-shared key (L2TP) and… >>> More
iptables -P FORWARD DROP makes port forwarding slow

as seen on Server Fault - Search for 'Server Fault'
I have three computers, linked like this: box1 (ubuntu) box2 router & gateway (debian) box3 (opensuse) [10.0.1.1] ---- [10.0.1.18,10.0.2.18,10.0.3.18] ---- [10.0.3.15] | box4, www [10.0.2.1] Among other… >>> More
IPtables AWS EC2 NAT/Reverse NAT - For Reverse Proxy style setup but with IPtables

as seen on Server Fault - Search for 'Server Fault'
I was thinking initially needing to do a reverse proxy or something so I could get some SSL/TLS traffic look like it is being terminated at a server and IP address in the AWS cloud, and then that traffic is forwarded onto our actual web servers that aren't in the cloud... I've not done much iptables… >>> More

Related posts about ip

Getting USB Wifi device to work

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I have been trying to get an Olitec Wifi N USB dongle to work. At first it lit up but wouldn't connect. A little Googling suggested that it would need ndiswrapper to make it work. After installing and trying to add driver with ndisgtk, I got the error message FATAL: Module ndiswrapper not found.… >>> More
Cisco 800 series won't forward port

as seen on Server Fault - Search for 'Server Fault'
Hello ServerFault, I am trying to forward port 444 from my cisco router to my Web Server (192.168.0.2). As far as I can tell, my port forwarding is configured correctly, yet no traffic will pass through on port 444. Here is my config: ! version 12.3 service config no service pad service tcp-keepalives-in service… >>> More
Cisco 881 losing NAT NVI translation config after reload

as seen on Server Fault - Search for 'Server Fault'
This is a weird one, so I'll try to explain in as much detail as I can so I'm giving the whole picture. As I've mentioned in my other questions, I'm in the process of setting up a new Cisco 881 as my WAN router and NAT firewall. I'm facing an issue where NAT NVI rules that I have configured are not… >>> More
Bind an ip address to Postfix as outgoing ip

as seen on Server Fault - Search for 'Server Fault'
Is that possible to bind all available public ip addresses on a server to one Postfix instance as its outgoing ip pool and let it choose a random ip or specified ip from the pool each time it sends out an email? If above is not possible, can it be configured to listen on one public ip address per… >>> More
What approach to take for SIMD optimizations

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I am trying to optimize below code for SIMD operations (8way/4way/2way SIMD whiechever possible and if it gives gains in performance) I am tryin to analyze it first on paper to understand the algorithm used. How can i optimize it for SIMD:- void idct(uint8_t *dst, int stride, int16_t *input… >>> More