SYN Flood Attack Mitigation with iptables & SYN Cookies

Defend Linux servers from volumetric TCP SYN Floods that exhaust kernel connection backlogs using SYN cookies and hashlimit rate-limiting.

1. Attack Signature & Impact Analysis

Critical (Infrastructure Outage)

Attackers send a deluge of TCP SYN requests with spoofed IPs, filling the kernel syncookie backlog (SYN_RECV state) until legitimate users cannot establish TCP handshakes.

2. Production Hardening Configuration (`/etc/iptables/rules.v4 or bash script`)

Deploy this validated configuration to your production server or reverse proxy:

# 1. Drop invalid packets early
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

# 2. Block TCP packets that are not SYN and do not belong to established connection
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

# 3. Limit SYN packets per source IP (Max 20/s with burst of 40)
iptables -A INPUT -p tcp --syn -m hashlimit --hashlimit-above 20/sec --hashlimit-burst 40 \
  --hashlimit-mode srcip --hashlimit-name syn_limit -j DROP

# 4. Save rules
netfilter-persistent save

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Check active half-open SYN connections
netstat -n -p TCP | grep SYN_RECV | wc -l
# Monitor iptables drop counter in real time
iptables -nvL -t mangle | grep DROP

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Ensure net.ipv4.tcp_syncookies = 1 is enabled in sysctl.conf, otherwise iptables drops alone may still exhaust local CPU during multi-gigabit attacks.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: