0
My set up is the following:
- Internet uplink (200Mbit)
- DMZ (1GB ethernet)
- Internal network (1gb internet)
- Log interface
My gateway is serving around 600 clients with 1400 iptables rules in place. HW configuration is as follows:
- 8 cores
- RAM: 32975472
Everything is fine until the point when I add following rule:
/sbin/iptables -I FORWARD -i eth-int -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j LOG --log-prefix ipt-dmz
After few seconds my gateway goes to completely unusable state, and I'm losing control over the box.
Any ideas about how to tune it up? The idea is to log every TCP-SYN packet over the "log" interface (dedicated interface just for this kind of traffic) and store these logs somewhere else. The gateway runs from flash drive, so I can not store such a data on the gateway.
Thanks for any hints.
Yes, I think this is what's happening. I've tried with limit as well (100/m) and I ended up with the same result. – dan dan – 2014-09-11T01:38:37.700