Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Is using Free/Open BSD + pf a workable option for filtering DDoS? Which of the two would perform better under heavy load? (SYN flood maxing a 1 gbit pipe)

Is this even an option to consider, or is a full hardware DDoS filter needed to get fast enough performance?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

2 Answers

up vote 0 down vote accepted

I think that pf can handle (synproxy,urpf and syncache tuning) this correctly on decent hardware without a problem using Freebsd or OpenBSD. I'll tend to use OpenBSD because i'm more familiar with it.

share|improve this answer
    
Do you have any sort of benchmark reference? synproxy is what I was looking at though; if it can process enough traffic fast enough, it would do what's needed. –  Eric Jul 8 '09 at 7:14
    
I would say that FreeBSD will perform a little better (like 2-3%) than OpenBSD with he same hardware. This article discuss pf performance but is probably a little outdated now: benzedrine.cx/pf-paper.html –  Maxwell Jul 8 '09 at 7:26
    
FreeBSD is likely to scale quite a bit better, since it's networking is quite a bit less locky. PF will still run single threaded though, so it may not scale to 1Gb/s –  Cian Jul 8 '09 at 9:15
add comment

Using any firewall as DDoS protection is a bad idea. DDoS attacks hit the most resource-intensive portion of any firewall, evaluating its ruleset for huge numbers of new connections. DDoS attacks melt down any firewall very quickly. How quickly and how big of an attack one can handle depends on how big of a firewall. In general, you don't want to look at a firewall as a solution to help with DDoS attacks as it will most likely become the most susceptible thing on your network to succumbing to those attacks.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.