Netgate SG-1000 microFirewall

Author Topic: What is the biggest attack in GBPS you stopped  (Read 48633 times)

0 Members and 1 Guest are viewing this topic.

Offline ghislain26

  • Newbie
  • *
  • Posts: 14
  • Karma: +2/-0
    • View Profile
What is the biggest attack in GBPS you stopped
« on: April 05, 2015, 03:09:30 am »
hi,

 i am hit by ddos (upd flood mostly) and looking for solutions, hopefully opensource ones. I wanted to know what was the biggest multi gigabits attack you successfully stopped with your pfsense setup in the field ( so not with nullrouting at ISP level) and what the hardware used was.

 My actuel issue is on the 5 to 10 gbps DDOS udp flood attacks so i search to see if a 20gbps filtering firewall could work in the real world of April 2015 and help me mitigate 1-16gbps attacks. My problem is to filter myself not ask upstrream to help so i really speak of how i can filter this and if anyone here had setup playing at this level of gbps.

regards,
Ghislain.

Offline Supermule

  • Hero Member
  • *****
  • Posts: 2530
  • Karma: +77/-102
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #1 on: April 05, 2015, 03:15:09 am »
You dont stand a chance with pfSense.

You need something that has been developed to mitigate the traffic.
Kind regards Brian


Offline ghislain26

  • Newbie
  • *
  • Posts: 14
  • Karma: +2/-0
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #2 on: April 05, 2015, 11:28:27 am »
that's bad news i hoped the  Chelsio cards and pci-e v3 and big xeon would have enough to rate limit upd if not more.
 
Is this in your experience a limit with the harware or the Os (freebsd here) .

I guess the answer is that the current software will not be fast enough in the current hardware but just for getting your insigth.

Does not seems a lot of people tried it i see only on the forum people like me that wonder if this can work but not that i can found that successfully done multi gigabits protection a reality with amd64 type servers and open source firewalling.

regards,
Ghislain

Offline Supermule

  • Hero Member
  • *****
  • Posts: 2530
  • Karma: +77/-102
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #3 on: April 05, 2015, 01:19:24 pm »
Its in the OS. Hardware can easily handle it if you got some muscle.

I can take this site offline using a specific type of traffic that takes no more than 70-80Mbps bandwith.

When that traffic hits pfSense, its dead. Goes offline instantly. No matter how powerful the hardware is.

I run 8 Core, 16GB ram and SSD. Dead in a second if it hits.
Kind regards Brian


Offline ghislain26

  • Newbie
  • *
  • Posts: 14
  • Karma: +2/-0
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #4 on: April 06, 2015, 03:07:08 am »
  Well that's scary.

 Any way to have information on how to do this because i would love to test this against the  pfsense and diverse others solution.

 I guess all the FreeBSD ones will suffer this issue. Perhaps others competing in this space like vyaos, routeros or netbsd or basic linux or even basic FreeBSD or modified pfsesnse if the latest kernel is patched against the issue could make it, depending on the issue used here. The issue is that the TCP/IP stack of FreeBSD is considered by the internet (and it is never wrong) to be the most reliable one and a lot of other's tcp/ip stack is borrowed from it so it is scary that it could be killed by 80mbps.


Offline Supermule

  • Hero Member
  • *****
  • Posts: 2530
  • Karma: +77/-102
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #5 on: April 06, 2015, 08:01:33 am »
I can tell you this much....

Windows firewall doesnt get affected by any of these attacks. If you put the server out front and only have WF running and forwarding traffic to the server then it can handle it easily.

It seems to only affect UNIX/Linux/BSD distros.
Kind regards Brian


Offline ghislain26

  • Newbie
  • *
  • Posts: 14
  • Karma: +2/-0
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #6 on: April 07, 2015, 02:50:33 am »
ok,

 seems nobody had any ddos success story yet so seems there is more thinking to be  done.

best regards,

BlueKobold

  • Guest
Re: What is the biggest attack in GBPS you stopped
« Reply #7 on: April 07, 2015, 10:16:20 am »
Quote
I can take this site offline using a specific type of traffic that takes no more than 70-80Mbps bandwith.
Scary or?

Quote
It seems to only affect UNIX/Linux/BSD distros.
Really sad to hear about it!

Pointed to the hardware it would not be the thing as I see it right.
Lanner FW-8895
test for pfSense are running, at the moment, but at this time it is not running related to the BIOS.
Lanner Packet Processing card
Would be awesome to see this card running under pfSense that can handle 40 GBit/s and comes with
a bypass option.

Offline NOYB

  • Hero Member
  • *****
  • Posts: 1703
  • Karma: +158/-273
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #8 on: April 07, 2015, 03:46:25 pm »
 
I can tell you this much....

Windows firewall doesnt get affected by any of these attacks. If you put the server out front and only have WF running and forwarding traffic to the server then it can handle it easily.

It seems to only affect UNIX/Linux/BSD distros.

Say what?  After all these years of Windows bashing by the nix and open source fans Windows firewall puts it to shame.  LOL
 

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #9 on: April 07, 2015, 04:46:56 pm »
Dunno really what's this debate about? You don't stop DDoS via packet filters. You null route it. It's damn useless to packet filter DDoS crap -- even if the firewall does not crash, the packet flood still totally fills your pipeline and renders it useless.
Do NOT PM for help!

Offline Supermule

  • Hero Member
  • *****
  • Posts: 2530
  • Karma: +77/-102
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #10 on: April 08, 2015, 03:48:02 am »
Depending on your pipe.

I have 2x10G in the datacenter on WAN and it doesnt get filled at all. So no blocking of pipe in the relation.

Its the handling of packets and yes you can packetfilter DDoS and not nullroute it.

Thats exactly what they want to achieve and we need a FW solution that can handle it at wirespeed.

No matter the cores and memory, pfSense still dies instantly.

So tell me where the culprit is, because traffic hardly get to the servers at all. If I stick a windows firewall on WAN directly on the server, then everything is fine even under several gigabit/s traffic patterns.
Kind regards Brian


Offline ghislain26

  • Newbie
  • *
  • Posts: 14
  • Karma: +2/-0
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #11 on: April 08, 2015, 04:06:28 am »
Depending on your pipe.

I have 2x10G in the datacenter on WAN and it doesnt get filled at all. So no blocking of pipe in the relation.

Its the handling of packets and yes you can packetfilter DDoS and not nullroute it.

Thats exactly what they want to achieve and we need a FW solution that can handle it at wirespeed.




exactly, right now 6GBPS do not fill the pipe of the main access that peak at 40gbps , but yes it fill the pipe of the server that is 1G. The purpose is to prevent nullrouting for all attack inferior to half the pipe by putting a firewall between the main router and the rack ( 20gbps is half the datacenter pipe).


Offline Supermule

  • Hero Member
  • *****
  • Posts: 2530
  • Karma: +77/-102
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #12 on: April 08, 2015, 04:14:33 am »
And you cant do that with pfSense.

It cant handle the DDoS traffic at all, especially SYN ACK and OVH scripts kills it instantly.
Kind regards Brian


Offline Nullity

  • Hero Member
  • *****
  • Posts: 973
  • Karma: +96/-9
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #13 on: April 08, 2015, 06:19:31 am »
That is an unorthodox way of arguing, Supermule; proving an item's inadequacies by proving your inability to skillfully operate said <Thing> (pfSense, Linux, Ford F150, shovels, pants, etc). To continually defend your stance, it is in your self-interest to not only stay ignorant, but perhaps even choose to learn exclusively the wrong ways of using <Thing>. The worse your skills become with <Thing> only validates your stand-point more and more. A strange way to prove a point... ;)




ghislain26, you say you can get your device installed earlier in the HOPs? Is this data-center multi-homed?
Please correct any obvious misinformation in my posts.
-Not a professional; an arrogant ignoramous.

Offline ghislain26

  • Newbie
  • *
  • Posts: 14
  • Karma: +2/-0
    • View Profile
Re: What is the biggest attack in GBPS you stopped
« Reply #14 on: April 08, 2015, 06:27:25 am »
ghislain26, you say you can get your device installed earlier in the HOPs? Is this data-center multi-homed?

From what i have been told the 40gbps from multiple peerings arrives at 2 redundant cisco where i can connect in 10gbps ports ( 2 ports in bonding here) so i can filter there , normaly the main routers go in 20gbps to the rooms routers.
So i would playing the role the room routers for my ip's with my filtering box and from there go to my rack probably in bridging mode. Of course the fact that i have basic knowledge of networking but not advanced ones limit my possibilities.