topic Re: Prevent DNS/DoS Attack in Firewall and Security Management

Prevent DNS/DoS Attack

tropicanaslim — Sun, 15 Jan 2023 16:18:18 GMT

Happy Weekend CheckMates..

But there is no weekend for mitigate an attack 🙂

so friday nite, my cust got an attack and impacted to some application can't access and dns was down.

we suspect because high rate access, either DoS or DNS attack.

Since all service already up and running well, my cust request to check and improve the current firewall which is Check Point as Perimeter Gateway.

anyone has idea how to check and analyse the issue and how we can protect from high access on dns or dos attack? Thankyou!

Re: Prevent DNS/DoS Attack

the_rock — Sun, 15 Jan 2023 20:27:34 GMT

Are there any logs you can share that could point us possibly in the right direction? Generally, make syre rules are "tightened" to only allow needed access, threat prevention blades are active (IPS at least with optimized profile at minimum).

Re: Prevent DNS/DoS Attack

Alex- — Sun, 15 Jan 2023 20:31:31 GMT

Check sk112454 - How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher) to address DoS attacks.

Re: Prevent DNS/DoS Attack

Timothy_Hall — Sun, 15 Jan 2023 23:13:55 GMT

Without knowing exactly what you were hit with, enabling the SecureXL penalty box is a great first step and easy to enable: sk112454 - How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher) If that doesn't do the trick you can look at setting some various connection and connection rate limits with fwaccel dos, that same SK has the info. If it was just a blunt bandwidth saturation attack you'll need help from your ISP.

Re: Prevent DNS/DoS Attack

Blason_R — Mon, 16 Jan 2023 02:03:53 GMT

That is absolutely right and has proved me beneficial so many times.