{{tag>Services "Service 8" "Service 10" "DDoS Protection"}}
====== DDoS Protection: UDP, SYN, HTTP Flood ======
{{indexmenu_n>12}}

SSG filters attack traffic before it reaches the protected website or client IP. Protection against three types of attacks is supported:

^ Attack ^ Protection mechanism ^ How to enable ^
| [[#syn_flood_protection|SYN flood]] | SYN PROXY: SSG responds to SYN itself and opens a session with the website only after the client confirms it | Service 10, ''syncf_*'' parameters |
| [[#udp_flood_protection|UDP flood]] | Dropping protocols irrelevant to the protected website or client IP | Protocol filter (''protocols.dscp'') |
| [[#http_flood_protection|HTTP flood]] | When the threshold is exceeded, redirection to a CAPTCHA page; users who pass the check are added to the whitelist | Service 10, ''ddos_*'' parameters; whitelist — service 8 |

SYN flood and HTTP flood protection can be configured via the GUI ([[dpi:dpi_components:dpiui:user_guide:ssg_control_section:services#ddos_protection|instructions]]) or via the CLI (see [[#service_management|Service Management]]).

===== SYN Flood Protection =====

A SYN flood attack increases resource consumption on the target system: for each incoming SYN packet, the system must reserve memory or generate a SYN+ACK response with a cryptographic cookie, perform a lookup in session tables, etc. Denial of service occurs at 100,000–500,000 packets per second, while even a gigabit link can deliver up to 1.5 million packets per second to a website.

SSG protects against SYN flood as follows:
  - detects an attack when the specified threshold of SYN requests not confirmed by the client is exceeded;
  - responds to SYN requests itself on behalf of the protected website (SYN PROXY mechanism);
  - establishes a TCP session with the protected website after the client confirms the request.

==== Protection Parameters ====

Protection mode (default ''0''):
  * ''0'' — protection is disabled;
  * ''1'' — activated automatically;
  * ''2'' — always enabled.
<code>
syncf_protection=1
</code>

Percentage of requests not confirmed by the client at which protection is activated automatically (default ''5'', can be changed online):
<code>
syncf_unconfirmed_percent=30
</code>

Threshold of SYN packets per second (without confirmation) considered normal (default ''50''):
<code>
syncf_threshold=50
</code>

Logging of protection triggers (default ''0''):
  * ''0'' — no logging;
  * ''1'' — log protection on/off switching.
<code>
syncf_trace=1
</code>

Interval for checking the number of SYN and confirmed SYN packets, ms (default ''100''):
<code>
syncf_check_tmout=100
</code>

Interval for monitoring responses to SYN+ACK generated by SSG, s (default ''60''):
<code>
syncf_tracking_packs_time=60
</code>

Protected ports are specified in ''/etc/dpi/fastdpi.conf'' (default ''80'', can be changed online). The setting applies to all protected websites:
<code>
syncf_ports=80:443
</code>

===== UDP Flood Protection =====

The attack is usually carried out with short or fragmented UDP packets at high PPS, which the target platform has to spend significant resources reassembling and analyzing.

Protection works by dropping the set of protocols irrelevant to the protected website or client IP. Protocol filter configuration is described in the [[dpi:dpi_options:opt_priority:priority_config|Priority Assignment]] option.

Only HTTP and HTTPS are relevant for a typical website, so the configuration looks like this:
<code>
http        cs0
https       cs0
default     drop
</code>

Convert the prepared file to the internal format and load it into DPI:
<code bash>
cat my_dscp.txt|lst2dscp protocols.dscp
mv protocols.dscp  /etc/dpi/protocols.dscp
service fastdpi reload
</code>

The same approach protects against DNS/NTP amplification attacks, in which the inbound link is flooded with traffic beyond its capacity. Such protection is limited by the operator's ability to provide additional link capacity. If it is exceeded, leasing additional links or redirecting traffic to specialized protection services will be required.

===== HTTP Flood Protection =====

In an HTTP flood, a botnet imitates the actions of legitimate users, usually choosing the most resource-intensive requests to the website. Due to the large number of participating computers, this leads to denial of service. SSG uses a CAPTCHA page to filter out bots.

How it works:
  - protection is activated when the threshold is exceeded (for example, the number of requests per second the website can comfortably handle);
  - only whitelisted users are allowed to access the website, others are redirected to the CAPTCHA page. The page is hosted on a separate server capable of withstanding a botnet of any size;
  - users who pass the test are added to the whitelist and continue to use the website without restrictions;
  - bots cannot get past the check page and do not load the website.

==== Protection Parameters ====

Protection is activated when one of the thresholds set in ''/etc/dpi/fastdpi.conf'' is exceeded.

Requests-per-second threshold:
<code>
ddos_reqsec_threshold=300
ddos_reqsec_variation=5
</code>
  * ''ddos_reqsec_threshold'' — number of requests per second to the protected website; usually set to the maximum value observed during normal website operation;
  * ''ddos_reqsec_variation'' — allowed deviation from the threshold, in percent, at which protection is enabled/disabled. Prevents flapping; default is 5%.

Packets-per-second threshold:
<code>
ddos_pktsec_threshold=5000
ddos_pktsec_variation=5
</code>
  * ''ddos_pktsec_threshold'' — number of packets per second to the protected website; usually set to the maximum value observed during normal website operation;
  * ''ddos_pktsec_variation'' — allowed deviation from the threshold, in percent (default 5%).

**If both thresholds are set, ''ddos_reqsec_threshold'' takes priority and ''ddos_pktsec_threshold'' is ignored.**

CAPTCHA page for redirection and the encryption key:
<code>
ddos_check_server=www.server_name.ru/path/page.html?
ddos_security_key=123567890
</code>
  * ''ddos_security_key'' — encryption key used to generate tokens that notify DPI that the check has been passed.

Logging of protection triggers:
<code>
ddos_trace=1
</code>

==== Trusted IP Whitelist ====

The list of trusted IPs can be collected in advance from the protected website's web server logs (the analysis script is written by you or by technical support) or from the log generated by DPI itself.

Loading the list into DPI (whitelist — **service 8**):
<code bash>
fdpi_ctrl load --service 8 --file ip_list.txt
</code>

For details on ''fdpi_ctrl'' commands and data persistence, see [[dpi:dpi_components:platform:subscriber_management|Subscriber Management]]. In this case, users of the protected website are treated as subscribers.

==== CAPTCHA Page ====

Requirements:
  * the page must be located behind DPI((Support for hosting CAPTCHA on external resources such as Cloudflare is planned.)), and service 10 with a protection profile must also be enabled for it. At a minimum, the profile must specify ''ddos_check_server'' and ''ddos_security_key''. For simplicity, you can use the same profile as for the protected website;
  * the page must be lightweight to withstand an influx of attacking computers.

Workflow:
  - the ''UrlRedir'' parameter with the URL of the protected website the user was heading to is passed to the page;
  - after the CAPTCHA is solved, an internal redirect to the CAPTCHA website is performed with an encrypted parameter signaling to DPI that the check has been passed;
  - then the user is redirected to the protected website according to the ''UrlRedir'' parameter.

Successful CAPTCHA entry means a human has visited the website: service 8 is automatically enabled for their IP address, and they continue to use the website without further checks. It makes sense to reset this service periodically, as previously clean computers may become infected.

The rules for generating the security token and an example CAPTCHA page can be obtained from technical support.

===== Service Management =====

SYN flood and HTTP flood protection for individual subscribers (protected IPs) is managed with the [[dpi:dpi_components:platform:subscriber_management:subsman_cmd|fdpi_ctrl]] command.

Command format:
<code>
fdpi_ctrl command --service 10 [option list] [IP list or login]
</code>

Command syntax and ways to specify IP addresses are described in [[dpi:dpi_components:platform:subscriber_management:subsman_cmd|Management Commands]].

==== Profile Parameters ====

The service profile is specified in JSON format. You can specify only some of the parameters: for example, only HTTP flood parameters, in which case SYN flood protection will be inactive. Unspecified parameters take default values.

^ Protection ^ Parameters ^
| [[#syn_flood_protection|SYN flood]] | ''syncf_protection'', ''syncf_trace'', ''syncf_check_tmout'', ''syncf_tracking_packs_time'', ''syncf_unconfirmed_percent'', ''syncf_threshold'' |
| [[#http_flood_protection|HTTP flood]] | ''ddos_trace'', ''ddos_reqsec_threshold'', ''ddos_reqsec_variation'', ''ddos_pktsec_threshold'', ''ddos_pktsec_variation'', ''ddos_check_server'', ''ddos_security_key'' |

==== Examples ====

Create a profile and enable protection with this profile for several subscribers:
<code bash>
fdpi_ctrl load profile --service 10  --profile.name test_protect --profile.json '{ "ddos_trace" : 1, "ddos_reqsec_threshold" : 100, "ddos_reqsec_variation" : 5, "ddos_pktsec_threshold" : 1000, "ddos_pktsec_variation" : 5, "ddos_check_server" : "captcha.server.ru/?", "ddos_security_key" : "123", "syncf_protection" : 0 , "syncf_trace" : 0 , "syncf_check_tmout" : 0 , "syncf_tracking_packs_time" : 0 , "syncf_unconfirmed_percent" : 0 , "syncf_threshold" : 0  }'
fdpi_ctrl load --service 10 --profile.name test_protect --ip 192.168.0.1
fdpi_ctrl load --service 10 --profile.name test_protect --ip 192.168.0.2
</code>

Find subscribers with the specified profile:
<code bash>
fdpi_ctrl list all --service 10 --profile.name test_protect
</code>

Change profile settings (applied to all subscribers with this profile):
<code bash>
fdpi_ctrl load profile --service 10  --profile.name test_protect --profile.json '{ "ddos_reqsec_threshold" : 0, "ddos_reqsec_variation" : 5, "ddos_pktsec_threshold" : 0, "ddos_pktsec_variation" : 5, "syncf_protection" : 1 , "syncf_trace" : 1 , "syncf_check_tmout" : 500 , "syncf_tracking_packs_time" : 180 , "syncf_unconfirmed_percent" : 25 , "syncf_threshold" : 100  }'
</code>

List service profiles and their settings:
<code bash>
fdpi_ctrl list all profile --service 10
</code>

Delete a profile (no subscribers may be using it):
<code bash>
fdpi_ctrl del profile --service 10  --profile.name test_protect
</code>

Disable protection for a subscriber:
<code bash>
fdpi_ctrl del --service 10 --ip 192.168.0.1
</code>

View protection status:
<code bash>
fdpi_ctrl list status --service 10 --ip 192.168.0.1
</code>
Output:
<code>
192.168.0.1   synf=0  ddos=1
</code>
  * ''synf=0'' — SYN flood protection is inactive;
  * ''ddos=1'' — HTTP flood protection is active.

==== Maximum Number of Profiles ====

Set in ''/etc/dpi/fastdpi.conf'' (default ''32'', maximum ''65535''):
<code>
max_profiles_ddos=32
</code>
This is a "cold" parameter: a restart is required after changing it.