raw table, NOTRACK, SYN flood

RouterOS General
1

Hi

I have a customers who love your products, are subject to DDoS attacks (SYN flood), and it hurts that Mikrotik doesn’t have “notrack” target, just SYN flood over his CCR will knock down CPU to 100%.
And if it had -j NOTRACK (or newer kernels: -j CT --notrack), it can be solved, he needed conntrack only for special case, and cannot turn it off completely.
Please consider adding this option, it should be very trivial to do, and will help a lot of people to solve their issues with conntrack overflow.
If possible take this matter seriously, because the only choice i have to show them how perfect are Mikrotik support, or to explain it is not, and to move them to alternative solution.

Thank you.

2

We can confirm this issue. Impossible to solve issue on any version ov RouterOS. Anybody can cause 100% CPU load on CCR oe any other Mikrotik router. Ih hurts…

3

u_p

4

+1, would be a great addition.

But, it is currently possible to solve the problem using two MT devices.

One closest to the connection where the SYN floods are received, with conntrack disabled, and stateless firewall rules to drop the problematic packets.

Then another MT device behind that, with conntrack enabled, performing whatever conntrack-utilizing operations you need.

–Eric

5

up_

6

+1.
Easily %100 under dDOS

7

Is it fixed in ROS 6.9 ?

8

+1
This addition could save some resources on the routers.

9

FYI information it is implemented:

What's new in 6.36rc...   :
...
*) firewall - added "/interface list" menu which allows to create list of interfaces which can be used as in/out-interface-list matcher in firewall;
*) firewall - added pre-connection tracking filter - "raw"  table, that allow to protect connection-tracking from unnecessary traffic;
*) firewall - allow to add domain name to address-lists (dynamic entries for resolved addresses will be added to specified list);
...
10

cool.but aside raw table that remove most overhead(because skipping before any processing happens)mentioned in changelog would admit that some networkers - didn’t implement flood detection(including syn flood) in their interfaces(sometimes its make sense not only on WAN interfaces, btw. espacially in big companies/networks), which is in my opinion A MUST for atleast edge/border gear. same about port scan detection and other usual things. personally i also would love fwsnort-alike features in ROS or something relevant around. and ZORP package(even as paid option) :stuck_out_tongue: