topic Re: Checkpoint FW R81 don't block SYN FLOOD in General Topics

Checkpoint FW R81 don't block SYN FLOOD

minhhaivietnam — Sun, 02 Jun 2024 01:22:45 GMT

Hi expert,

I made a simple DOS test : flooding about 5000 syn packets from one source to firewall R81 (with SYN Attack and IPS enable).

But firewall didn't block these connections, it still accept.

SYN Attack is activated:

But fw still accept all connections

Please help , I want fw block syn flood.

Thanks all!!

Re: Checkpoint FW R81 don't block SYN FLOOD

_Val_ — Sun, 02 Jun 2024 07:13:31 GMT

Check you have activated SynAttack feature properly, including the thresholds and delay. Read through sk120476, relevant portion of sk112241, and notes from SecureXL ATRG for the matter.

Also note, with the default settings, synattack has 5 seconds delay for activation.

Instead of traffic logs, check your IPS logs for SynAttack triggers.

Re: Checkpoint FW R81 don't block SYN FLOOD

minhhaivietnam — Sun, 02 Jun 2024 09:02:12 GMT

Thanks admin,

Finally, i use this command "fwaccel dos rate add concurrent-conns 100 destination cidr:192.168.199.10 service any" then it blocks as expected

Also i need to change DOS simulation :

from: 5000 packets with same source port

to: 5000 packets with random source port

Re: Checkpoint FW R81 don't block SYN FLOOD

the_rock — Sun, 02 Jun 2024 21:46:38 GMT

For sure the SK's @_Val_ sent you are super relevant in this case.

Best,

Andy

Re: Checkpoint FW R81 don't block SYN FLOOD

ANARINE — Thu, 18 Dec 2025 11:10:43 GMT

Ok I performed the syn flood in my testlab as well. I have observed the below

When syn flood prevention aka syndefender is enabled, it only activates after the threshold is reached (default 5000 syns). You can confirm that syndefender is active and enforcing cookies by running the 'fwaccel monitor state' command). At this point the fw acts as man-in-the-middle: It does not forward the SYN packet to the web server unless it received an ACK from the client containing a valid cookie. The OP was looking for syn drops in the fw logs, but the fw doesn't drop the syns, it just doesn't forward them to the webserver. The OP enabled a dos rate policy which is a separate mechanism from syndefender.

The below sk explains the process

Accelerated SYN Defender