help with filtering ddos attacks in iptables

martyns · 01-05-2019, 05:20 PM

Hi, Im having some ddos attacks bypasses on my vps, Im using only teamspeak 3 and only UDP is problem here, how do I filter ddos attack, I heard its best to filter by payload how do I do that? I think I have some tcpdumps to upload if someone can help me

nini09 · 01-07-2019, 03:16 PM

You can use following command to block UDP DDoS from particular IP, such as 10.10.10.10
iptables -t raw -A PREROUTING -p udp -s 10.10.10.10 -j DROP

martyns · 01-07-2019, 05:12 PM

Lol, yea for DoS.. for DDoS is useless because you'll be getting hundreds spoofed addresses so yea, and my questin is how to filter by payload

nini09 · 01-08-2019, 02:34 PM

iptables -A INPUT -m string --algo bm --string "test" -j DROP

martyns · 01-08-2019, 04:02 PM

I just enter payload instead test?

nini09 · 01-09-2019, 03:21 PM

Above is sample, if payload include "test" keyword, the packet will be dropped.

TenTenths · 01-13-2019, 01:39 PM

However...... DDoS mitigation at server / router level is too late. The traffic is already coming down your link and that alone can / will clog your bandwidth and make your server unreachable.

The brutal reality is that a properly formed DDoS attack needs mitigation at ISP level or through a DDoS mitigation / traffic cleaning service.

nini09 · 01-14-2019, 02:26 PM

Based on my understanding, Linux can only do basic or simple DoS or DDoS.