Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 2 answers
  • Subscribers 4 subscribers
  • Views 12325 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Limit incomming http/s connections per IP Address?

TimBoggs

Is there a way with Sophos UTM 9 to limit the connections per second for web requests? Preferably per requesting IP address.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to sachingurung

    Does this restriction work on all http traffic or just TCP SYN attacks? So if you have an automated process that runs and submits too many legitimate requests to your API, would the IPS settings throttle the requests per second?

  • 0 in reply to TimBoggs

    Tim, please share the reason for this question - what problem are you trying to address with this?

    Cheers - Bob

  • 0 in reply to TimBoggs

    HI TIm , 

    As the KB article provided by Sachin go to section 

    Anti-DoS/Flooding

    For sessions per address you may configure the TCP flag . But this may affect the multiple sessions to the same host . 

    TCP SYN Flood Protection

    To employ TCP SYN flood protection, enable "Use TCP SYN Flood Protection" 

     Mode: The following modes are available: 

    •  Both source and destination addresses: Select this option if you want to drop SYN packets that match both source and destination IP address. First, SYN packets are filtered that match the source IP address. Second, if there are still too many requests they will additionally be filtered according to the destination IP address. This mode is set as default. 
    •  Destination address only: Select this option if you want to drop SYN packets according to the destination IP address only. 
    • Source address only: Select this option if you want to drop SYN packets according to the source IP address only. 

    Logging: This option lets you select the log level. The following levels are available: 

    • Off: Select this log level if you want to turn logging completely off. 
    • Limited: Selecting this log level will limit logging to five packets per second. This level is set as default. 
    • Everything: Select this log level if you want verbose logging for all SYN (TCP) connection attempts. Note that SYN (TCP) flood attacks may lead to extensive logging. 
    •  Source Packet Rate: Here you can specify the rate of packets per second that is allowed for source IP addresses. 
    •  Destination Packet Rate: Here you can specify the rate of packets per second that is allowed for destination IP addresses. 

      Note: It is important to enter reasonable values here, for if you set the rate too high, your web server, for instance, might fail because it cannot deal with such an amount of SYN (TCP) packets. On the other hand, if you set the rate too low, your firewall might show some unpredictable behavior by blocking regular SYN (TCP) requests. Reasonable settings for every system heavily depend on your hardware. Therefore, replace the default values by numbers that are appropriate for your system. Click Apply and your settings will be saved.

     

    Taken from article 115154

    Note : This may affect downloads and may affect slow browsing and the value should be set by testing on a PC . Background services are also taken into consideration .

    Thanks and regards

    Aditya Patel | Network and Security Engineer.

  • 0 in reply to BAlfson

    It's really about throttling legitimate traffic, like clients that get impatient and repeatedly hit submit. Or as is sometimes the case, when they drop a stack of papers on their keyboard. It can also be when someone is accessing the API and spin up too many processes. Not really looking at intentionally malicious traffic.

  • 0 in reply to TimBoggs

    In TMG it was called Flood Mitigation and we had a great deal of control over the limits on different types of connections.

  • 0 in reply to TimBoggs

    That's what Aditya posted about above.  WebAdmin uses a different metaphor, more is under the covers and behind the scenes, but just keep asking questions and you'll deliver a great result.

    Cheers - Bob

  • 0 in reply to BAlfson

    In the referenced article it says: "The ASG can protect against flooding by throttling connections that are not following the normal TCP/IP protocols." Later followed with: "On the other hand, if you set the rate too low, your firewall might show some unpredictable behavior by blocking regular SYN (TCP) requests".

    So, does it rate limit all TCP connection requests, or is it looking for specific types of malicious traffic?

    TMG let me specify HTTP traffic connections per minute and we actually had users who could exceed the limit just filling out forms on websites and clicking next. We tweaked as necessary.

  • 0 in reply to TimBoggs

    Two different things.  See the 'Protocol Handling' section on the 'Advanced' tab in 'Firewall' for the first question in your last post.

    Cheers - Bob