Can disabling port forwaring entry thwart DoS attack?

Feb 16, 2018
6
0
10
Hi,
I want to host my web pages on my Raspberry Pi, which I already have and I'm thinking of buying a domain. I have been assigned with public static IP by my provider with unrestricted and non-blocked ports 80 and 443, so that's not a problem.

I have a TP-LINK TL-WR841N router with it's WAN port configured to the public IP and I will be forwarding ports for the RPi. My router has the following features, which I already activated: SPI Firewall, ICMP-FLOOD attack filtering, UDP-FLOOD filtering, TCP-SYN-FLOOD filtering and Forbid Ping from WAN port. In case of a DoS attack (which I think won't happen, because there will be nothing wrong on the web, but anything can happen), will removing/disabling the port forwarding entry stop the attack?

When I scan an closed port with nmap, it reports "filtered" and the mobile app's (Net Analyzer by "techet" for Andrord) port analyzing feature reports "blocked". All ports are blocked if I disable all the port forwarding entries on the router.

What I want to achieve is working internet connection for the computers connected to the router (in its LAN) while the DoS attack. I don't care about the website, which won't work for some time, it's not something mission-critical.

Thanks.
 
Solution


It's not the port, but rather the public facing IP address.
They are simply hammering your public IP address. Clogging up the bandwidth.

Any port forwarding or filtering only happens within the router, after the incoming traffic flood has already happened.

USAFRet

Titan
Moderator
A DoS or DDoS only stops when they want to stop.

Eventually, when they discover their traffic flood is doing nothing or connecting to nothing...they will stop. Eventually.
In the meantime, all that traffic is hammering your router, blocking off any other normal traffic.
 
Feb 16, 2018
6
0
10


So even the filtered port means nothing? I've heard something that it's impossible to DDoS a filtered port.
 

USAFRet

Titan
Moderator


It's not the port, but rather the public facing IP address.
They are simply hammering your public IP address. Clogging up the bandwidth.

Any port forwarding or filtering only happens within the router, after the incoming traffic flood has already happened.
 
Solution