Being DDoS'd. Can I cap connections?

darksmiley · 05-28-2015, 04:21 AM

Hi. We think we're getting repeatedly DDoS'd.

I run Ubuntu 12.04 on my server.

Is there any way to completely limit all connections, so that a DDoS cannot bring down the surrounding network and then hopefully I can allow through my own connection for maintenance?

I know that this means my websites would go down, but at least I'd still have access and a degree of control and wouldn't jeopardise my hosting.

I read that I could do this with my http server - lighttpd - but I was wondering if Linux can do this holistically?

Thanks!

tombelcher7 · 05-28-2015, 07:51 AM

I am by no means an expert and would encourage others to comment but the first thing I thought off was conntrack and found this article for Redhat which may be relevant:

http://rhelblog.redhat.com/2014/04/1...-linux-7-beta/

TobiSGD · 05-28-2015, 08:49 AM

I have asked the mod for this sub-forum to move your thread to the security sub-forum.
In the meantime, please have a look at this information: http://www.linuxquestions.org/questi...61/#post222579

Amarildo · 05-29-2015, 10:10 AM

My firewall rules are set so nobody can ping me:

Code:

iptables -N In_RULE_1
iptables -A INPUT -p icmp  -m icmp  --icmp-type any  -j In_RULE_1
iptables -A In_RULE_1  -j LOG  --log-level info --log-prefix "RULE 1 -- DENY "
iptables -A In_RULE_1  -j DROP

I also have an anti-spoof rule:

Code:

iptables -N In_RULE_0
iptables -A INPUT -i your_network_card   -s your_host_name  -j In_RULE_0
iptables -A In_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- DENY "
iptables -A In_RULE_0  -j DROP

In my case:

Code:

iptables -N In_RULE_0
iptables -A INPUT -i enp0s7   -s amarildo   -j In_RULE_0
iptables -A In_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- DENY "
iptables -A In_RULE_0  -j DROP

Also, a rule to block invalid packets:

Code:

iptables -N drop_invalid
iptables -A OUTPUT   -m state --state INVALID  -j drop_invalid
iptables -A INPUT    -m state --state INVALID  -j drop_invalid
iptables -A INPUT -p tcp -m tcp --sport 1:65535 --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j drop_invalid
iptables -A drop_invalid -j LOG --log-level debug --log-prefix "INVALID state -- DENY "
iptables -A drop_invalid -j DROP

Also a no-Whois rule:

Code:

iptables -N In_RULE_2
iptables -A INPUT -p tcp -m tcp  --dport 43  -j In_RULE_2
iptables -A In_RULE_2  -j LOG  --log-level info --log-prefix "RULE 2 -- DENY "
iptables -A In_RULE_2  -j DROP

And a no-xmas-scan rule

Code:

iptables -N In_RULE_4
iptables -A INPUT -p tcp -m tcp   --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN  -j In_RULE_4
iptables -A In_RULE_4  -j LOG  --log-level info --log-prefix "RULE 4 -- DENY "
iptables -A In_RULE_4  -j DROP

Protection against IP fragments too:

Code:

iptables -N In_RULE_5
iptables -A INPUT -p all  -f   -j In_RULE_5
iptables -A In_RULE_5  -j LOG  --log-level info --log-prefix "RULE 5 -- DENY "
iptables -A In_RULE_5  -j DROP

No tracerout either:

Code:

iptables -N In_RULE_7
iptables -A INPUT -p udp -m udp  --dport 33434:33524  -j In_RULE_7
iptables -A In_RULE_7  -j LOG  --log-level info --log-prefix "RULE 7 -- DENY "
iptables -A In_RULE_7  -j DROP

And no "who" too:

Code:

iptables -N In_RULE_6
iptables -A INPUT -p udp -m udp  --dport 513  -j In_RULE_6
iptables -A In_RULE_6  -j LOG  --log-level info --log-prefix "RULE 6 -- DENY "
iptables -A In_RULE_6  -j DROP

If you're interested in my rules http://pastebin.com/UsufFHFk

salasi · 05-29-2015, 04:44 PM

Quote:

Originally Posted by darksmiley

Hi. We think we're getting repeatedly DDoS'd.

Why do you think that? Perhaps as relevant, if you have captured some packets, then maybe there are some characteristics of the packets that are useful in filtering out the bad stuff from the good stuff. Feel free to obfuscate any of your own addresses before posting anything.

Quote:

Originally Posted by darksmiley

Is there any way to completely limit all connections, so that a DDoS cannot bring down the surrounding network and then hopefully I can allow through my own connection for maintenance?

Well, if for example, all of the DDOS packets are on one port and you have SSH on another port, you could drop all of the packets coming in some port/range of ports, and allow through the packets on the SSH port. Probably won't work perfectly, but may work well enough.

Quote:

Originally Posted by darksmiley

I know that this means my websites would go down, but at least I'd still have access and a degree of control and wouldn't jeopardise my hosting.

Websites will probably be intermittently accessible, but that may be better than where you are now. A lot depends on whether there are bottlenecks upstream that are limitations.

Quote:

Originally Posted by darksmiley

I read that I could do this with my http server - lighttpd - but I was wondering if Linux can do this holistically?

I don't know what you mean by 'holistically', but the further upstream you do this, the less unnecessary processing you do before dropping stuff, the less chance that you run out of processing power to deal with the packets.

Oh, and you can rate limit almost anything in iptables. The difficulty is doing it without doing more harm than good...

joec@home · 06-04-2015, 01:54 PM

Personally, I prefer using the DDOS protection from APF firewall. This will dynamically defend against such attacks. Also, it is a free download.

Advanced Policy Firewall
https://www.rfxn.com/projects/advanced-policy-firewall/

How To Install And Configure Advanced Policy Firewall
https://www.howtoforge.com/how-to-in...-on-centos-5.3

I am not finding a good tutorial on the DDOS section, so unfortunately I must say "Read The Manual". The DDOS section is fairly simple though.

unSpawn · 06-06-2015, 05:20 AM

Quote:

Originally Posted by salasi

Why do you think that?

Valid question!

Quote:

Originally Posted by darksmiley

Is there any way to completely limit all connections, so that a DDoS cannot bring down the surrounding network and then hopefully I can allow through my own connection for maintenance?

Limiting connections can be done using iptables modules but DoS and DDoS measures should be applied upstream. Please see common SANS and other DoS / DDoS mitigation documentation.