Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Is using Free/Open BSD + pf a workable option for filtering DDoS? Which of the two would perform better under heavy load? (SYN flood maxing a 1 gbit pipe)

Is this even an option to consider, or is a full hardware DDoS filter needed to get fast enough performance?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

up vote 1 down vote accepted

I think that pf can handle (synproxy,urpf and syncache tuning) this correctly on decent hardware without a problem using Freebsd or OpenBSD. I'll tend to use OpenBSD because i'm more familiar with it.

share|improve this answer
    
Do you have any sort of benchmark reference? synproxy is what I was looking at though; if it can process enough traffic fast enough, it would do what's needed. –  Eric Jul 8 '09 at 7:14
    
I would say that FreeBSD will perform a little better (like 2-3%) than OpenBSD with he same hardware. This article discuss pf performance but is probably a little outdated now: benzedrine.cx/pf-paper.html –  Maxwell Jul 8 '09 at 7:26
    
FreeBSD is likely to scale quite a bit better, since it's networking is quite a bit less locky. PF will still run single threaded though, so it may not scale to 1Gb/s –  Cian Jul 8 '09 at 9:15

Using any firewall as DDoS protection is a bad idea. DDoS attacks hit the most resource-intensive portion of any firewall, evaluating its ruleset for huge numbers of new connections. DDoS attacks melt down any firewall very quickly. How quickly and how big of an attack one can handle depends on how big of a firewall. In general, you don't want to look at a firewall as a solution to help with DDoS attacks as it will most likely become the most susceptible thing on your network to succumbing to those attacks.

share|improve this answer
    
This is not true. Get a firewall that can handle line-rate so it doesn't melt. It can be very useful, for example if it employs a synproxy. –  Craig Jan 14 at 23:33
    
It's absolutely true. It's 4 years later so things are a little diff today, but still today finding a firewall that'll handle line rate multi-Gb at 64 byte frames is difficult to impossible depending on what options you want to or can afford to consider. It's much more practical to find something that'll do 1 Gb line rate with 64 byte frames today than it was in 2011. Just multiply that 1 Gb a few times to take into account the years, and it's still true today. –  Chris Buechler Jan 16 at 6:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.