LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 04-08-2017, 03:19 PM   #16
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled

try put

-d 162.222.73.243
 
Old 04-08-2017, 03:41 PM   #17
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
i add it and no positive result

this my
Code:
iptables -L
Code:
root@vmi:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       udp  --  anywhere             162-222-73-121.saucelabs.net  udp spt:27043 #conn src/32 > 1 ctstate NEW,RELATED,ESTABLISHED
DROP       udp  --  anywhere             anywhere             udp dpt:27043 state NEW recent: UPDATE seconds: 1 hit_count: 2 name: DEFAULT side: source mask: 255.255.255.255
           udp  --  anywhere             anywhere             udp dpt:27043 state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       udp  --  anywhere             162-222-73-121.saucelabs.net  udp spt:27043 #conn src/32 > 1 ctstate NEW,RELATED,ESTABLISHED
DROP       udp  --  anywhere             162-222-73-121.saucelabs.net  udp spt:27043 state NEW recent: UPDATE seconds: 1 hit_count: 2 name: DEFAULT side: source mask: 255.255.255.255
           udp  --  anywhere             162-222-73-121.saucelabs.net  udp spt:27043 state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255
can iptables solve this or i need other firewall ??
 
Old 04-08-2017, 04:04 PM   #18
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
they can, this is rules for that. on that server do you only use this udp port.

Last edited by end; 04-08-2017 at 04:05 PM.
 
Old 04-08-2017, 04:14 PM   #19
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by end View Post
they can, this is rules for that. on that server do you only use this udp port.

no, i use other ports for my clients, but i lunch cs1.6 server on port 27043 for test dos attack and i attack just this port not else ports

no one these moment attack me, i just make test dos attack on port 27043 from external server for test my firewall
 
Old 04-08-2017, 04:18 PM   #20
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
try this

iptables -I INPUT -s 162-222-73-121 -dport 27043 -j DROP

and test. this drop all on that port just see is this working.
 
Old 04-08-2017, 05:02 PM   #21
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
i try your rule
Code:
iptables -I INPUT -s 162.222.73.121 -dport 27043 -j DROP
but i have got this error
Code:
Bad argument `27043'
Try `iptables -h' or 'iptables --help' for more information.
as i understand from this

this rule block attacker ip from accessing gameserver ip on port 27043 and the attacker ip can access other yes ?

so i search on google and i got this rule to do this
Code:
iptables -I INPUT -p tcp -d 162.222.73.121 --dport 27043 -j DROP
iptables -I INPUT -p udp -d 162.222.73.121 --dport 27043 -j DROP
after this transaction i make test dos on my gameserver and it's not block attacker ip !!

i think the result must the attacker cant dos me on this port

so i decide to block the attacker ip using this rule
Code:
iptables -A INPUT -s 162.222.73.98 -j DROP
iptables -A OUTPUT -s 162.222.73.98 -j DROP
an no effect ! he still can mak DOS on my game server

i need to notice i take this point in mind (the attacker ip don't still same as previous ip because i am using free rdp to to make test dos attack)

Last edited by Obada; 04-08-2017 at 05:03 PM.
 
Old 04-08-2017, 05:19 PM   #22
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
block ip with drop rule should work.

try

iptables -I INPUT -s 162.222.73.98/32 -j DROP
 
Old 04-08-2017, 05:44 PM   #23
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
same problem....

look i was have ufw firewall on my ubuntu server but the ufw is disabled now just iptables is active that effect ??

and i was installed ddos-deflate script and this using iptables as a base that effect too ?


i made ping from attacker server to my game server before & after blocking attacker ip and two result same

Code:
Pinging $gameserver with 32 bytes of data:
Reply from $gameserver: bytes=32 time=172ms TTL=48
Reply from $gameserver: bytes=32 time=172ms TTL=48
Reply from $gameserver: bytes=32 time=172ms TTL=48
Reply from $gameserver: bytes=32 time=172ms TTL=48

Ping statistics for $gameserver:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 172ms, Maximum = 172ms, Average = 172ms

this mean i have issue on my iptables

Last edited by Obada; 04-08-2017 at 06:09 PM.
 
Old 04-08-2017, 06:10 PM   #24
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
no effect.

try

iptables -I INPUT -s 162-222-73-121.saucelabs.net -j DROP

or

iptables -I INPUT -d 162-222-73-121.saucelabs.net -j DROP

change ip to ip that is now.

Last edited by end; 04-08-2017 at 06:12 PM.
 
Old 04-08-2017, 06:21 PM   #25
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by end View Post
no effect.

try

iptables -I INPUT -s 162-222-73-121.saucelabs.net -j DROP

or

iptables -I INPUT -d 162-222-73-121.saucelabs.net -j DROP

change ip to ip that is now.
no effect :|


i will try to make dos on tcp port, i was have tcp protection so i will test it if i can block it....

after make DOS Attack on tcp purt the ddos deflate blocked the attacker

Code:
List of currently banned ip's.
===================================
1491694534 162.222.73.93 108

Last edited by Obada; 04-08-2017 at 06:28 PM.
 
Old 04-08-2017, 06:23 PM   #26
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
post

iptables -nvL
 
Old 04-08-2017, 06:32 PM   #27
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
Code:
root@vmi:~# iptables -nvL
Chain INPUT (policy ACCEPT 4362 packets, 317K bytes)
 pkts bytes target     prot opt in     out     source               destination
  408 19616 DROP       all  --  *      *       162.222.73.120       0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 6659 packets, 731K bytes)
 pkts bytes target     prot opt in     out     source               destination

this appear after flush iptables and make new dos attack on tcp port then ddos deflate block the attacker
 
Old 04-08-2017, 06:34 PM   #28
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
i realy dont know way iptables rule dont work in your case maybe there is some other rule that overide them.
 
Old 04-08-2017, 06:39 PM   #29
Obada
LQ Newbie
 
Registered: Apr 2017
Posts: 21

Original Poster
Rep: Reputation: Disabled
and yes after ddos deflate script i can't ping my gameserver any more from attacker machine

Code:
C:\Windows\system32>ping $gameserver

Pinging $gameserver with 32 bytes of data:
Request timed out.
Request timed out.

that mean my iptables not work.....

so i will try to remove the ddos deflate
 
Old 04-08-2017, 06:40 PM   #30
end
Member
 
Registered: Aug 2016
Posts: 233

Rep: Reputation: Disabled
great then you solved it.

try remove and restart. and then try our approach it should work.

first try with ip block. if that work try connection limit options. and see whats happening.

Last edited by end; 04-08-2017 at 06:46 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables: trying to forward UDP traffic jbbroccard2 Linux - Networking 2 07-27-2017 01:11 AM
UDP traffic unauthorized on Ubuntu 10.04 galen Linux - Security 2 03-12-2011 07:05 PM
Should traffic control root qdsic & child class limit traffic? Washington Ratso Linux - Networking 0 02-23-2011 07:16 PM
[HELP] redirect traffic to spesific port based on Traffic Content using iptables summersgone Linux - Server 2 06-22-2009 11:26 AM
how to limit traffic a device (eth0) using iptables? modpriest Linux - Software 1 09-04-2008 01:22 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:32 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration