reserving bandwidth for certain IP's in case of DoS

[wyn]

Hello All,

Is it possible with QoS to reserve an amount of bandwidth for certain ip's? (i use vyatta in bridging mode)

I have a 100mbit connection, and in case of a denial of service attack i want to reserve 10Mbit to allow access from my IP, so that the maximum used amount bandwidth for the denial of service attack is 90Mbit, is this possible?

Best regards,

Wyn

[kenfelix]

Are you talking in or outbound?

example,

If a DoS is conduct from any outside_sources to a inside host, you will need the bandwidth allocation done at the uplink connection. Placeing QoS and traffic policers at the interface the attacker is hitting or to a host on your inside network, is not going to help you at all.

Now, if you wanted to provide QoS in case a host is compromise and is part of a bigger Bot attack, you could deploy traffic allocation in this scenario with ease.

[kenfelix]

Are you talking in or outbound?

example,

If a DoS is conduct from any outside_sources to a inside host, you will need the bandwidth allocation done at the uplink connection. Placeing QoS and traffic policers at the interface the attacker is hitting or to a host on your inside network, is not going to help you at all.

Now, if you wanted to provide QoS in case a host is compromise and is part of a bigger Bot attack, you could deploy traffic allocation in this scenario with ease.

[wyn]

Hey kenfelix, thanks for you reply.

In most cases attacks from the outside are filtered by our network provider. Our most common scenario of a DoS is when a person abuses one of our webservers to execute something malicious like a php or perl udp flood (which doesnt require any special privileges).

Do you happen to have a simple example how my configuration should look like in this case?

[kenfelix]

Your best solution for this would be a snort rule to limiton the number sessions and or some PCRE expression or content inspection. You probably can find a can'd rule available and use that or re-write it, to meet your needs.

I haven't played with the IDS features on vyatta, but that's what I think would work in the scenarios that you described. Get a few books or google searches on advance snort rules and then look at the IDS features within vyatta.