1

How do you automatically block all incoming traffic by creating custom rule for every connection (in real time) using iptables?

To clarify - the situation is that my linux box is being DDOSed via port 80 and I want to set iptables to catch and block all attacking bots. After couple of hours (and hopefully all the bots used up), I lift the policy and let the legitimate www traffic in.

EDIT: Or if you could suggest any other way of protecting myself against (probably) distributed SYN flood.

Improve this question

1 Answer 1

Reset to default
1

No, this won't do it for you.

Dynamically blocking each connection will give you the exact same result as setting a blanket rule to block all connections irrespective of their source -- that is, your site will be inaccessible.

If your problem is simply a syn flood, then just turn on syncookies and call it a day. But if it's a true DDoS attack, then you'll need to do a bit more.

Instead, you need to filter your traffic based on some factor present in all the DDoS traffic, but absent in the legitimate traffic, such as the user-agent header, assuming this is web traffic. I've successfully done this using nginx as a reverse proxy, but bear in mind that setting up and managing such a thing is non-trivial and requires an admin who knows his technology. You're not going to resolve it by following instructions on some blog.

If you don't have one, then find one.

Improve this answer
2
  • Since I cant diagnose the attack or differentiate malicious packets I thought about catching all the current and malicious traffic and set rules for it. Dropping all incoming traffic would stop working after I lifted the rule - but if I permanently block all current traffic, then lift the auto-adding filter - new and potential legitimate traffic would be allowed with all the bots filtered out (and some unlucky clients:>). But still, your answer clarified the situation a bit, thanks.
    – Halik
    Mar 26, 2011 at 22:14
  • Unfortunately that doesn't actually work in my experience -- I tried. What I've seen during most DDoS attacks is that hosts are often being constantly added and removed to the attack pool. You can't just block a specific IP set because within an hour there's thousands of new IPs.
    – tylerl
    Mar 27, 2011 at 8:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .