@JonathanLee said in HE tunnel broker questions:
I went the old way of wan only
The old way ?
If your uplink is rather big, like a Gigagbit or way more, it's the dangerous way.
Incoming, Internet originated traffic, is normally dropped without any further actions taken.
If you decide to have that traffic analyzed by, for example, snort, then you expose yourself to a much greater DOS risk : the more traffic comes in, the harder snort is going to "snort" on it.
Now, all it takes it : I, with my bots, send you a loads of 'suspect' traffic and your firewall comes to a crawling halt.
Remember : you can not stop the the traffic coming into your WAN, only your ISP can. If you want to spend a zillion CPU cycles on every bad packet, and lots of these are coming in, your firewall will get overloaded.