Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently found a DoS Defense setting in my DrayTek Vigor 2830 router, which is disabled as default. I'm running a very small server on this network and I take it very serious to have the server up and running 24/7.

I'm a bit unsure if the DoS Defense could cause me any kind of problems. I haven't experienced any DoS attacks yet, but I would like to avoid possible attacks. Is there any reason not to enable the DoS Defense setting?

share|improve this question
2  
Rather than ask us if you should/should not enable this "DoS Defense" feature, why not ask your router vendor what it actually does when you check the box, then decide if those rules make sense in your environment? –  voretaq7 Dec 20 '12 at 21:23
    
(After digging up the manual from their website I can say the list of things it checks for and deals with is a relatively sane one -- Unlikely to break anything legit, so no real harm in turning it on. Just don't expect it to protect you from everything - there are some attacks it can't mitigate) –  voretaq7 Dec 20 '12 at 21:31
    
As this is mostly a risk analysis question, you might consider asking to migrate this to Information Security. –  AviD Dec 21 '12 at 8:39

3 Answers 3

up vote 15 down vote accepted

It means the router has to maintain additional state and do additional work on each packet. And how can it really help in the case of a DoS? All it can do is drop a packet that you have already received. Since you've already received it, it has already done the damage by consuming your inbound Internet bandwidth.

share|improve this answer
    
I'm pretty sure this is to keep the service running, not to stop the bandwidth drain. I really can't agree with this answer at all. –  SpacemanSpiff Dec 20 '12 at 18:37
3  
@SpacemanSpiff: Two reasons this is not true: 1) A typical ADSL link can't carry enough traffic to take out a service anyway. Typical DoS attacks over such links work by consuming your bandwidth. 2) The device can't reliably tell attack traffic from legitimate traffic. So stopping the DoS attack is just a DoS attack on yourself since you're dropping the legitimate traffic too. (At most, this will preserve your outbound bandwidth for other services because you're not replying to the attack traffic. But with no useful inbound, protecting your outbound usually doesn't help much.) –  David Schwartz Dec 20 '12 at 18:41
    
Pretty much... Generally, if you get dossed on any line a dreytek would be holding up, you're going down. –  Sirex Dec 20 '12 at 19:21
    
What you've told him to do is turn off the following, just so you know: SYN flooding, UDP flooding, ICMP flooding, Port Scan Detections, IP Spoofing, Tear Drop Attacks. Just because this vendor leaves it off by default, doesn't mean everyone does. Juniper NetScreen and SRX Branch routers come out this enabled, as does the ASA5505. –  SpacemanSpiff Dec 20 '12 at 21:10
2  
@SpacemanSpiff: If they can overwhelm his bandwidth, they can take him down even with it on. He's dropping the traffic after it has consumed his bandwidth. Having a defended edge inside the slowest link does you little to no good. Most likely, his weakest link is the router CPU and his inbound bandwidth. –  David Schwartz Dec 20 '12 at 21:20

One reason to not enable the DoS Defense setting is that trying to protect systems from DOSed will spike the CPU of the router/firewall causing a DoS itself.

share|improve this answer

Yes, absolutely, turn it on.

If this is implemented correctly your firewall's engine should inspect each packet. Once it's determined to drop this traffic as part of a DoS attack, it should install a rule into hardware and silently drop the traffic instead of processing it again and again. Where it will still fall on it's face is a distributed attack, but I suggest you turn this on.

What kinds of services is that server hosting?

share|improve this answer
    
It is running a lot of different stuff: IIS, MSSQL Databases, MySQL databases, Apache, Minecraft and all kinds of random stuff I'd need a server for :) –  Cupcake Dec 20 '12 at 18:49
3  
If the traffic was hurting your link, it'll still be hurting your link. If it wasn't, you're now likely to be dropping at least some legitimate traffic, making the DoS attack worse. On a SoHo router, this is bad advice. It's off by default for a reason. –  David Schwartz Dec 20 '12 at 19:26
    
I'm pretty sure screens and DoS rules do not drop OTHER types of traffic. –  SpacemanSpiff Dec 20 '12 at 21:02
    
The whole point of a DoS is to make the DoS traffic indistinguishable from legitimate traffic so the victim has to choose between dropping legitimate traffic and responding to the DoS traffic. For example, if you're serving HTTP on port 80, one typical DoS attack you'll see is a multi-source SYN flood on port 80. How can you tell the flood SYNs from legitimate client SYNs? –  David Schwartz Dec 20 '12 at 21:13
1  
"If implemented correctly" isn't assured; especially on consumer grade hardware. The Netgear router I was using at home several years ago had a major bug in it's DOS filter. It was possible to send a single packet with malformed data that would cause DOS filter to crash and take the router down with it. –  Dan Neely Dec 20 '12 at 21:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.