FreeBSD firewall block syn flood attack

[Brett Glass]

At 07:45 AM 5/20/2003, Mike Silbersack wrote:

>It would be possible to add the syncache / syncookies to ipfw so that it
>could be used to protect hosts behind it, but I don't think anyone has
>tried an implementation of that yet.

This would require the creation of a general transparent TCP proxy
which did the 3-way handshake and then connected to the internal
host only if the handshake succeeded. Trouble is, it would need
to translate sequence numbers throughout the entire session.
Could be done with divert sockets and a daemon like natd, I 
imagine.

--Brett