limit udp traffic per ip using iptables only

Obada · 04-08-2017, 06:43 PM

Quote:

Originally Posted by end

great then you solved it.

try remove and restart. and then try our approach it should work.

no not solved that protection just on tcp ports

the tcp port protection come from ddos deflate script

but yes i will try to remove the ddos deflate and try your approach

end · 04-08-2017, 06:59 PM

and restart maybe somthing stack somewere and oweriding rules

Obada · 04-08-2017, 07:34 PM

all iptables problem because the ufw is exist so i deleted my ufw firewall using this commands

Code:

sudo ufw disable
sudo apt-get remove ufw
sudo apt-get purge ufw

and now i can block ip using iptables

now i test your rules for protect from udp flooding ....

Obada · 04-08-2017, 07:48 PM

i add this rules

Code:

iptables -I INPUT -p udp --dport 27043 -m state --state NEW -m recent --set
iptables -I INPUT -p udp --dport 27043 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP
iptables -I INPUT -p udp -m udp -d 162.222.73.15 --sport 27043 -m connlimit --connlimit-above 1 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP

iptables -I OUTPUT -p udp -d 162.222.73.15 --sport 27043 -m state --state NEW -m recent --set
iptables -I OUTPUT -p udp -d 162.222.73.15 --sport 27043 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP
iptables -I OUTPUT -p udp -m udp -d 162.222.73.15 --sport 27043 -m connlimit --connlimit-above 1 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP

but no effect

i block ip manually

Code:

iptables -I INPUT -s 162.222.73.15 -j DROP
iptables -I INPUT -d 162.222.73.15 -j DROP

iptables -I INPUT -s 162-222-73-15.saucelabs.net -j DROP
iptables -I INPUT -d 162-222-73-15.saucelabs.net -j DROP

the result is tcp closed and got request out when i make ping,

but the attacker still can mak udp flood even if he blocked !

end · 04-08-2017, 07:51 PM

try

iptables -I INPUT -p udp --dport 27043 -m state --state NEW -m recent --set
iptables -I INPUT -p udp --dport 27043 -m state --state NEW -m recent --update --seconds 1 --hitcount 1 -j DROP
iptables -I INPUT -p udp -m udp -s 162.222.73.15 --dport 27043 -m connlimit --connlimit-above 1 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP

end · 04-08-2017, 07:58 PM

i forgot after every rule do iptables -F to delete previous rules. and try block ip and try attack.

verify with iptables -nvL that all chains is to accept then add rule. if that rule dont work again iptables -F and add another. that was problem first time its not ddos script. i forgot to mention this.

Obada · 04-08-2017, 08:02 PM

Quote:

Originally Posted by end

i forgot after every rule do iptables -F to delete previous rules. and try block ip and try attack.

verify with iptables -nvL that all chains is to accept then add rule. if that rule dont work again iptables -F and add another. that was problem first time its not ddos script. i forgot to mention this.

i made this code after finished any fail test

Code:

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

end · 04-08-2017, 08:03 PM

iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

this is right order

end · 04-08-2017, 08:05 PM

hove do you test udp flood i need test this myself

Obada · 04-08-2017, 08:09 PM

yes i test it and no effect the udp flood still working

Obada · 04-08-2017, 08:09 PM

i can send you my udp flood script

i am using udpflood script writing in perl on rdp for making test attack on my gameserver(ubuntu)

you can using it udp-flood.pl

end · 04-08-2017, 10:18 PM

actualy rules working i was confused from your iftop output. if your see output you can see that your ip dont send any packets to attacker only attacker to you. even if you have drop rules as default policy. and that normal because you need to see whats happening to your network that didnt meen that they packets actually pass firewall and affect function of network. put log on rules and you will see that everything is dropped.

Obada · 04-09-2017, 09:01 AM

you are using udp flood and and you are protected ?? by using your approach ?

what os you run ?

for me not work even if i block the ip i will show you the steps i made and i fail :\

first step: flush the iptables using this:

Code:

iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

second step: blocking ip

Code:

iptables -I INPUT -s 162.222.73.7 -j DROP
iptables -I INPUT -d 162.222.73.7 -j DROP

after that i try to ping my game server from attacker machine

ping from attacker machine

as you see i got

Code:

Request timed out.
Request timed out.

then make attack on my game server

attack screenshot

i let the attacker machine running so let's see our game server iftop and check our game server ping

iftop screenshot

my game server running in this port got offline and not only this port all game server on my vps got offline

game server status screenshot

any issue with my steps ??

Obada · 04-09-2017, 09:03 AM

can you check my problem by teamviewer ?

Obada · 04-09-2017, 09:59 AM

i see someone like my problem

http://serverfault.com/questions/691...-an-ip-for-udp