How to reduce SYN flooding using sysctl.conf

Linux has a nice file for setting up kernel value at boot time. This file can be found in

 /etc/sysctl.conf

 If you open and edit, you will find many values you can transform to improve security on your server.

I think the most important value you can set to secure your TCP connection is:

 net.ipv4.tcp_syncookies=1

 Another thing you can do is reduce the timeout value from 60 to 30 seconds, this is not TCP standard at all to do that, but at least, the connection refresh will be faster than default.

Note: keep in mind this reduces impact of SYN flooding, it will not stop them completely. Make sure you don’t set this value too low over wise it could create TCP loss packet situation.

 net.netfilter.nf_conntrack_tcp_timeout_syn_recv=30

Last thing you can make is to create Iptables entry to limit them on your server.

# create new chains

iptables -N syn-flood

# limits incoming packets

iptables -A syn-flood -m limit --limit 10/second --limit-burst 50 -j RETURN

# log attacks

iptables -A syn-flood -j LOG --log-prefix "SYN flood: "

# silently drop the rest

iptables -A syn-flood -j DROP