FireWall-1 FAQ: How Does SYNDefender Work?
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
A normal TCP connection starts like this:
- Client sends SYN packet to Server
- Server sends SYN/ACK packet to Client
- Client sends an ACK packet.
- Connection starts.
SYNDefender generally mucks with the SYN/ACK responses to help keep SYN attacks abay. There are three SYNDefender modes, SYN Relay, SYN Gateway, and Passive SYN Gateway.
SYN Relay Mode works like this (assume Firewall is between Client and Server):
- Client sends SYN packet to Server, but is intercepted by Firewall.
- Firewall sends back a SYN/ACK packet to Client.
- Client send ACK packet to Firewall.
- Firewall sends SYN packet to Server on behalf of Client.
- Server sends SYN/ACK packet to Firewall.
- Firewall sends ACK packet to Server.
- Connection starts.
The short version of this: FireWall-1 performs the entire handshake process on behalf of the client before sending it onto the client. This is the most secure, but also places the highest overhead on the firewall.
Note that this feature is not present in FireWall-1 4.0 or 4.1. It is present in 3.0 and earlier versions. It has returned in NG FP1 and FP2, though this property disappeared again in NG FP3.
SYN Gateway Mode works like this (again, assume Firewall is between Client and Server):
- Client sends SYN packet to Server
- Server sends SYN/ACK packet to Client
- Firewall sends ACK packet to Server on behalf of Client.
- Client sends ACK packet to Server. The server receives it, but ignores it as it is redundant.
- Connection starts.
The short version of this: FireWall-1 tracks the state of the handshaking process (it does not perform any handshaking on behalf of the server) and will reset “invalid” connection attempts as necessary. This is the recommended setting if SYNDefender will be employed on your network.
Passive SYN Gateway works like this (…)
- Client sends SYN packet to Server. Firewall notes the handshake attempt.
- Server sends SYN/ACK packet back to Client, but is intercepted by Firewall.
- Firewall resends SYN/ACK to client.
- Client sends ACK packet to server.
- Connection starts.
The short version of this: Like SYN Gateway, the Passive SYN Gateway tracks the state of the handshake. The primary difference between the two modes is that the SYN Gateway will “open” the connection to the server without verifying the final “ACK” from the client. This means connections may get opened unnecessarily, but they will be reset if SYNDefender does not see the final “ACK” packet from the client.
In either case, if there is no ACK from the client within a certain period of time, the connection will be reset.
