DDoS Protection: UDP, SYN, HTTP Flood

SSG filters attack traffic before it reaches the protected website or client IP. Protection against three types of attacks is supported:

SYN flood and HTTP flood protection can be configured via the GUI (instructions) or via the CLI (see Service Management).

A SYN flood attack increases resource consumption on the target system: for each incoming SYN packet, the system must reserve memory or generate a SYN+ACK response with a cryptographic cookie, perform a lookup in session tables, etc. Denial of service occurs at 100,000–500,000 packets per second, while even a gigabit link can deliver up to 1.5 million packets per second to a website.

SSG protects against SYN flood as follows:

1. detects an attack when the specified threshold of SYN requests not confirmed by the client is exceeded;
2. responds to SYN requests itself on behalf of the protected website (SYN PROXY mechanism);
3. establishes a TCP session with the protected website after the client confirms the request.

Protection mode (default 0):

• 0 — protection is disabled;
• 1 — activated automatically;
• 2 — always enabled.

syncf_protection=1

Percentage of requests not confirmed by the client at which protection is activated automatically (default 5, can be changed online):

syncf_unconfirmed_percent=30

Threshold of SYN packets per second (without confirmation) considered normal (default 50):

syncf_threshold=50

Logging of protection triggers (default 0):

• 0 — no logging;
• 1 — log protection on/off switching.

syncf_trace=1

Interval for checking the number of SYN and confirmed SYN packets, ms (default 100):

syncf_check_tmout=100

Interval for monitoring responses to SYN+ACK generated by SSG, s (default 60):

syncf_tracking_packs_time=60

Protected ports are specified in /etc/dpi/fastdpi.conf (default 80, can be changed online). The setting applies to all protected websites:

syncf_ports=80:443

The attack is usually carried out with short or fragmented UDP packets at high PPS, which the target platform has to spend significant resources reassembling and analyzing.

Protection works by dropping the set of protocols irrelevant to the protected website or client IP. Protocol filter configuration is described in the Priority Assignment option.

Only HTTP and HTTPS are relevant for a typical website, so the configuration looks like this:

http        cs0
https       cs0
default     drop

Convert the prepared file to the internal format and load it into DPI:

cat my_dscp.txt|lst2dscp protocols.dscp
mv protocols.dscp  /etc/dpi/protocols.dscp
service fastdpi reload

The same approach protects against DNS/NTP amplification attacks, in which the inbound link is flooded with traffic beyond its capacity. Such protection is limited by the operator's ability to provide additional link capacity. If it is exceeded, leasing additional links or redirecting traffic to specialized protection services will be required.

In an HTTP flood, a botnet imitates the actions of legitimate users, usually choosing the most resource-intensive requests to the website. Due to the large number of participating computers, this leads to denial of service. SSG uses a CAPTCHA page to filter out bots.

How it works:

1. protection is activated when the threshold is exceeded (for example, the number of requests per second the website can comfortably handle);
2. only whitelisted users are allowed to access the website, others are redirected to the CAPTCHA page. The page is hosted on a separate server capable of withstanding a botnet of any size;
3. users who pass the test are added to the whitelist and continue to use the website without restrictions;
4. bots cannot get past the check page and do not load the website.

Protection is activated when one of the thresholds set in /etc/dpi/fastdpi.conf is exceeded.

Requests-per-second threshold:

ddos_reqsec_threshold=300
ddos_reqsec_variation=5

• ddos_reqsec_threshold — number of requests per second to the protected website; usually set to the maximum value observed during normal website operation;
• ddos_reqsec_variation — allowed deviation from the threshold, in percent, at which protection is enabled/disabled. Prevents flapping; default is 5%.

Packets-per-second threshold:

ddos_pktsec_threshold=5000
ddos_pktsec_variation=5

• ddos_pktsec_threshold — number of packets per second to the protected website; usually set to the maximum value observed during normal website operation;
• ddos_pktsec_variation — allowed deviation from the threshold, in percent (default 5%).

If both thresholds are set, ddos_reqsec_threshold takes priority and ddos_pktsec_threshold is ignored.

CAPTCHA page for redirection and the encryption key:

ddos_check_server=www.server_name.ru/path/page.html?
ddos_security_key=123567890

• ddos_security_key — encryption key used to generate tokens that notify DPI that the check has been passed.

Logging of protection triggers:

ddos_trace=1

The list of trusted IPs can be collected in advance from the protected website's web server logs (the analysis script is written by you or by technical support) or from the log generated by DPI itself.

Loading the list into DPI (whitelist — service 8):

fdpi_ctrl load --service 8 --file ip_list.txt

For details on fdpi_ctrl commands and data persistence, see Subscriber Management. In this case, users of the protected website are treated as subscribers.

Requirements:

• the page must be located behind DPI¹⁾, and service 10 with a protection profile must also be enabled for it. At a minimum, the profile must specify ddos_check_server and ddos_security_key. For simplicity, you can use the same profile as for the protected website;
• the page must be lightweight to withstand an influx of attacking computers.

Workflow:

1. the UrlRedir parameter with the URL of the protected website the user was heading to is passed to the page;
2. after the CAPTCHA is solved, an internal redirect to the CAPTCHA website is performed with an encrypted parameter signaling to DPI that the check has been passed;
3. then the user is redirected to the protected website according to the UrlRedir parameter.

Successful CAPTCHA entry means a human has visited the website: service 8 is automatically enabled for their IP address, and they continue to use the website without further checks. It makes sense to reset this service periodically, as previously clean computers may become infected.

The rules for generating the security token and an example CAPTCHA page can be obtained from technical support.

SYN flood and HTTP flood protection for individual subscribers (protected IPs) is managed with the fdpi_ctrl command.

Command format:

fdpi_ctrl command --service 10 [option list] [IP list or login]

Command syntax and ways to specify IP addresses are described in Management Commands.

The service profile is specified in JSON format. You can specify only some of the parameters: for example, only HTTP flood parameters, in which case SYN flood protection will be inactive. Unspecified parameters take default values.

Create a profile and enable protection with this profile for several subscribers:

fdpi_ctrl load profile --service 10  --profile.name test_protect --profile.json '{ "ddos_trace" : 1, "ddos_reqsec_threshold" : 100, "ddos_reqsec_variation" : 5, "ddos_pktsec_threshold" : 1000, "ddos_pktsec_variation" : 5, "ddos_check_server" : "captcha.server.ru/?", "ddos_security_key" : "123", "syncf_protection" : 0 , "syncf_trace" : 0 , "syncf_check_tmout" : 0 , "syncf_tracking_packs_time" : 0 , "syncf_unconfirmed_percent" : 0 , "syncf_threshold" : 0  }'
fdpi_ctrl load --service 10 --profile.name test_protect --ip 192.168.0.1
fdpi_ctrl load --service 10 --profile.name test_protect --ip 192.168.0.2

Find subscribers with the specified profile:

fdpi_ctrl list all --service 10 --profile.name test_protect

Change profile settings (applied to all subscribers with this profile):

fdpi_ctrl load profile --service 10  --profile.name test_protect --profile.json '{ "ddos_reqsec_threshold" : 0, "ddos_reqsec_variation" : 5, "ddos_pktsec_threshold" : 0, "ddos_pktsec_variation" : 5, "syncf_protection" : 1 , "syncf_trace" : 1 , "syncf_check_tmout" : 500 , "syncf_tracking_packs_time" : 180 , "syncf_unconfirmed_percent" : 25 , "syncf_threshold" : 100  }'

List service profiles and their settings:

fdpi_ctrl list all profile --service 10

Delete a profile (no subscribers may be using it):

fdpi_ctrl del profile --service 10  --profile.name test_protect

Disable protection for a subscriber:

fdpi_ctrl del --service 10 --ip 192.168.0.1

View protection status:

fdpi_ctrl list status --service 10 --ip 192.168.0.1

Output:

192.168.0.1   synf=0  ddos=1

• synf=0 — SYN flood protection is inactive;
• ddos=1 — HTTP flood protection is active.

Set in /etc/dpi/fastdpi.conf (default 32, maximum 65535):

max_profiles_ddos=32

This is a "cold" parameter: a restart is required after changing it.