DDOS, UDP-flood (базовая защита iptables)

[Refresh]

1337322228, если спецификация протокола, который использует valve, не изменилась - поможет. Если протокол поменяли - не поможет.

 

[mIDnight]

iptables -t mangle -N Filter-Game
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP 
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP 
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p udp -m udp -m recent --dport 27015 -j DROP --update --seconds 30 --hitcount 5 --name VSE-ddos
iptables -t mangle -A PREROUTING -p udp -m udp -m conntrack -m string --dport 27015 --ctstate NEW -j Filter-Game --hex-string "|ffffffff54|" --algo bm
iptables -t mangle -A Filter-Game -m hashlimit -m recent -j DROP --hashlimit-name speedlimit --hashlimit-mode srcip,dstport --hashlimit-srcmask 24 --hashlimit-above 7/sec --hashlimit-burst 14 --set --name VSE-ddos
iptables -t mangle -A Filter-Game -j RETURN

 

[Kobra]

For owners of 2CPU, 2GB RAM (and more), I recommend downloading these kernel options:

I have 1 core , is this relevant?

 

[kto-to]

Kobra, нет. Написано же это только для тех у кого 2 и более CPU.

 

[Nordic Warrior]

kto-to, это написано только про параметры ядра в конце статьи.

 

[dimkazai4enko96]

Midnight1337, спасибо за правила. Скажите, пожалуйста, они должны спасать от таких атак?

 

[1337322228]

@Refresh,а если несколько серверов хочу и проц 8 ядер и канал гиг ?

 

[kto-to]

1337322228, Всё будет в порядке.

 

[drag1c]

Hi,

I am right now in this topic concerning my machine, where I host CS servers for my party, but I use open game panel.
Are these settings OK with machine of Ryzen 5, 4 x Core 4.7 Ghz, 8 Gb Ram ?
If not, do you have something different?

 

[kto-to]

drag1c, Это подходит всем, это же универсальная защита просто для сервера/вдс, где располагается игровой сервер. А чтобы ПУ какая-либо функционировала нормально, нужно посмотреть как я полагаю, чтобы для корректной работы были открыты соответствующие используемые порты для этой ПУ.

 

[drag1c]

kto-to I've did this change on my machine and now fast download daemon does not load web page (sv_downloadurl "xxx").

By Open Game Panel, it goes via port 8080.
Did it somehow close 8080 so it stopped working?
How to enable this?

Or it could be because of some changes in .htaccess file?

P.S. Agent is running, Daemon is running.

Edit:
I've changed iptables, by adding this row:

-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT

Now it works.
Please, tell me if this is okay. I've added it just under:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

In 33 row.

I will point out that 8080 is not SSL secured now. I think I should make it secured.

 

[yamusaka]

drag1c, ssl is not 8080 port SSL works on 443 protocol

 

[drag1c]

drag1c, ssl is not 8080 port SSL works on 443 protocol

Yeah, I found on internet...
Could they flood me over port 8080, since I enabled it in iptables and if possible, how to prevent that?

 

[1337322228]

kto-to,тебя так и не забанили ещё за мультиакк ?
а хулиган ?

 

[csr7]

my ssh port is not 22 but something else. how to set it so i'll still have access to my vps?

 

[drag1c]

I've just found out I didn't save it properly... Kek.

When I open rules.v4, everything is written inside, but terminal gave me error, after I typed:
sudo iptables-restore < /etc/iptables/rules.v4

Bad argument `COMMIT'
Error occurred at line: 135
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

How I can fix it or does it need fixing at all?

 

[drag1c]

I've just found out I didn't save it properly... Kek.

When I open rules.v4, everything is written inside, but terminal gave me error, after I typed:
sudo iptables-restore < /etc/iptables/rules.v4

Bad argument `COMMIT'
Error occurred at line: 135
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

How I can fix it or does it need fixing at all?

Fixed... Now is fine.

 

[csr7]

my ssh port is not 22 but something else. how to set it so i'll still have access to my vps?

anyone can help?

 

[mIDnight]

anyone can help?

find / -name "sshd_config" -print

Inside the config you will find something that looks like this:
before:

#Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress ::
uncomment # and change your SSH port

Then restart SSH service to apply changes
service sshd restart

 

[Kobra]

Does anyone have any idew how to fix this ?