TODO:
- research if adding any iptables ddos protection rules by default would make sense in context of Whonix
- improving ddos resistance
- not opening new privacy issues
- not opening new fingerprinting vectors
- consider implementing them
Description
Description
Details
Details
- Impact
- Normal
Related Objects
Related Objects
- Mentioned In
- T565: control-port-filter ddos test
Event Timeline
Comment Actions
Basic research I did: http://people.netfilter.org/hawk/presentations/devconf2014/iptables-ddos-mitigation_JesperBrouer.pdf
some things like enabling tcp timestamps dont make sense from a privacy perspective so ignore them.
Comment Actions
Apart from SYNPROXY there are more effective iptables rules for DDoS mitigation discussed here: https://javapipe.com/iptables-ddos-protection
Some of those should be added to whonix-gw-firewall as well imo.