DoS Protection from Asus Firewall - on or off?

[Jack Yaz]

Just wondering if there's any point this being on, since I imagine any serious DDOS will drop the CPU like a bad habit anyway.

 

[strangeluck]

I personally don't use it because I noticed it causes me to drop connections to peers when torrenting.

 

[Vexira]

I read merlin saying it slows down the cpu with extra rules, and load but that's confusing since net gear has theirs on by default and it was still fast.
So I'm not entirely sure how it could hurt, id say test it.

 

[Vexira]

From the man himself RMerlin
"Enabling the DoS protection will add firewall rules that will limit connection attempts (from a port scanner for example) and ICMP PINGs to a maximum of 1 per second. This will add some extra processing on the router as it will need to track the rate of each incoming connection, so it can degrade throughput performance under higher loads.

The default is "Disabled", and this is usually fine that way for a home router. If someone was attempting to truly DoS you, chances are your connection would still be flooded to the point of being unusable, so this setting is of limited usefulness. Someone pointing a few dozens of gigabits of flood at you through a DDoS will take you offline no matter what protection your router has."
https://www.snbforums.com/threads/rt-n66u-noob-questions.8122/

 

[Jack Yaz]

From the man himself RMerlin
"Enabling the DoS protection will add firewall rules that will limit connection attempts (from a port scanner for example) and ICMP PINGs to a maximum of 1 per second. This will add some extra processing on the router as it will need to track the rate of each incoming connection, so it can degrade throughput performance under higher loads.

The default is "Disabled", and this is usually fine that way for a home router. If someone was attempting to truly DoS you, chances are your connection would still be flooded to the point of being unusable, so this setting is of limited usefulness. Someone pointing a few dozens of gigabits of flood at you through a DDoS will take you offline no matter what protection your router has."
https://www.snbforums.com/threads/rt-n66u-noob-questions.8122/

Thanks, I've now set to disabled.

 

[Vexira]

no problem, though if it is the case, I'm not sure why netgear has their enabled by default.

 

[RMerlin]

The performance impact is probably not even measurable with modern router's CPUs.

 

[netware5]

The performance impact is probably not even measurable with modern router's CPUs.

@RMerlin, does RT-N66U CPU fall into the "modern router's CPUs"?

 

[Vexira]

So it's fine to enable on the 88u?

 

[Vexira]

@RMerlin, does RT-N66U CPU fall into the "modern router's CPUs"?

im going to specualte hes refering to the arm cpus not the mips, keep in mind i coud be wrong, my basis is that arm platform router cpus are running the trend micro software where as mips cant.

 

[RMerlin]

@RMerlin, does RT-N66U CPU fall into the "modern router's CPUs"?

Yes. The mentioned impact is more for pre-wifi days, where we had 200 MHz CPUs handling our traffic. Unless of course you run a very busy 1 Gbps link, in which case it might perhaps be measurable. I doubt anyone ever measured the latency introduced by a single iptables rule, so I'm just going by gut feeling here.

 

[Vexira]

i stand corrected, so in that case a router like the gt 5300 should basically have the smallest amout of cpu interrupt with dos protection enabled?

 

[RMerlin]

i stand corrected, so in that case a router like the gt 5300 should basically have the smallest amout of cpu interrupt with dos protection enabled?

Yes, unless you're having that very busy 1 Gbps link hooked to it (and by busy, I mean with lots of new connections, since DoS rules should only be processed on new connections).

 

[Boggy]

Just wondering if there's any point this being on, since I imagine any serious DDOS will drop the CPU like a bad habit anyway.

Using it will give you stutters in games like CS:GO.
I've tried it, it's only "good" if you're not gaming or streaming on a low bandwidth.

 

[Vexira]

Using it will give you stutters in games like CS:GO.
I've tried it, it's only "good" if you're not gaming or streaming on a low bandwidth.

That's odd to me Netgear has Thiers on and when I had Thier router it was perfectly fine oddthey must have some sort of black box code to get that working smoothly.