<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
and I have see now in /proc/sys/net/ipv4 is on - itīs only commented
in /etc/sysctl.conf!<br>
<br>
Ok, but why the SYN-FLOOD is gooing throu the PVE-Firewall? <br>
<br>
smurf-filter is ON too!<br>
nf_conntrack_max was on DEFAULT - now: 196608 (changed in GUI)<br>
nf_conntrack_tcptimeout_established is: 18000 (long time ago changed
in GUI)<br>
PVE-Firewall work - I see iptables -L and ipset list is with
standard blocked IPs <br>
<br>
I have read, but dont know is good for proxmox:<br>
<br>
tcp_syn_retries now 5 - change to 3 is that better?<br>
tcp_max_syn_backlock is 2048 - good ?!<br>
<br>
<br>
Regards<br>
<br>
Detlef<br>
<br>
<div class="moz-cite-prefix">Am 04.06.2015 um 01:54 schrieb Detlef
Bracker:<br>
</div>
<blockquote cite="mid:556F93BC.3010201@1awww.com" type="cite">
<pre wrap="">Dear,
is that a good Idea to prevent SYN FLOOD on Proxmox host with uncomment
#net.ipv4.tcp_syncookies=1
Or is their something other to prevent in the PVE-Firewall?
We had in 2 days 2 SYN FLOOD to MySQL-Servers on many Containers with
diferent destination
IPs and comes only from one IP! The OVH DDoS Mitigation stop many of
this traffic but not all!
Only with blacklisting of the IP we have stop. But how we can stop this
on other ways?
Regards
Detlef
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
pve-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:pve-devel@pve.proxmox.com">pve-devel@pve.proxmox.com</a>
<a class="moz-txt-link-freetext" href="http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel">http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel</a>
</pre>
</blockquote>
<br>
</body>
</html>