Firewall

[elite90]

Does anyone have any suggestions for firewall software?

 

We are having problems with network connections on our servers giving out, so we KVM on and netstat and see 100s of connections from the same IP or IP range connecting to the same PID. Basically we want something that will know to block this.

 

We run 2003 64-bit and money is no object.

 

Thanks

[DougK94]

Sonds like time for an OS reload as your server has been compromised.

[elite90]

I don't think so. It's just a form of dos attack. We have dozens of boxes and this issue pops up once in awhile.

 

I mean, turning off the service that the connections are being made to or blocking the IPs in IPSEC and restarting the network interface fixes it.

[DougK94]

OK

 

I used IPSEC rules to block all un needed ports. Windows firewall works fine for most for gameservers, and it is easy using the scripts in each game config to open the ports.

 

I saw somewhere a long time ago, think it was theplanet forums, a very nice script that will auto block offending IP's using IPSEC.

[elite90]

Thanks, I'll do some Googling.

 

I'm curious to know what the big guys like Art of War and Counter-Strike.com do.

[dimitrifrom31]

OK

 

I used IPSEC rules to block all un needed ports. Windows firewall works fine for most for gameservers, and it is easy using the scripts in each game config to open the ports.

 

I saw somewhere a long time ago, think it was theplanet forums, a very nice script that will auto block offending IP's using IPSEC.

 

Im looking into IPsec possibilities and I couldnt find such a script but would be interested if sum1 got any info about it.

 

Im currently making a batch script to automatically block TCP outgoing traffic and allow only needed ports. that woul be a gd complement to win firewall.

[agentpr24]

Is there something else other than IPSec or its just the best one for Win2003/08?

[dimitrifrom31]

Is there something else other than IPSec or its just the best one for Win2003/08?

 

ipsec isnt a firewall it just manages the way packets are handled according to their origina / direction.

If you set it to reject some packets then it can have a kind of firewall behaviour.

 

I will most likely use win firewall for incoming traffic and ipsec for outgoing one.