Hey guys, the topic is : Hardening of Ziti Controller / Public-Router. The goal is to reach max. service availability, even on attacks. I had to use Port 443 for Ziti-Router-Port and Ziti-Ctrl-Edge-Advertised-Port because from some customer networks other ports are blocked (8440, 8441 and 8442). …

@rcsoleng , what are your thoughts on Ziti Firewall, GitHub - netfoundry/zfw: An ebpf based firewall for openziti edge-routers/tunnelers , and using dynamically ebpf rules to limit attacks on controller/router?

I'm happy to be corrected, but I thought zfw's function was to add INPUT rules for a host firewall where a Ziti router is configured as a LAN gateway, i.e., layer 2 peers have an IP route to the Ziti router because it's providing an infrastructure interceptor as an alternative to installing Ziti sof…

I understood that zfw is being worked on for an enhancement to provide an ebpf based ddos protection mechanism for our controllers (which I figure could be use for routers too)... I do not know the status of it.

Hi @PhilipGriffiths yes you are correct as an extension to zfw I have added a DDOS protection mechanism currently only for controllers. The attacks that we are testing/mitigating right now are HTTPS flood and SYN flood attacks. A DDOS monitoring service scans specific controller logs for previously …

Ziti Hardening IDS/IPS

Support

qrkourier May 15, 2024, 2:45pm 2

Cross-link to one related threadpost: Howto Install Router - #14 by qrkourier

Topic		Replies	Views
Need help on ziti firewall	26	325	October 24, 2024
Options to mitigate DOS/DDOS attacks against public controller/router General Questions	3	260	April 9, 2024
Trouble setting up a Ziti Ethernet Gateway using ZFW and ZET General Questions	2	89	November 16, 2025
Ziti-edge-tunnel data flows General Questions	2	68	February 6, 2025
Howto Install Router Support	18	1110	May 15, 2024

Ziti Hardening IDS/IPS

Related topics