Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

So, it appears about 2 IP addresses are overloading my HTTP server (apache) over UDP and I am unable to stop this using IP Tables. I am using CentOS 5. I managed to block some other IP addresses that were overloading TCP, but can't seem to stop the UDP.

I've narrowed down the offenders to connecting to random ports using UDP connections, but the following entry in iptables isn't working:

-A INPUT -s <offending IP> -p udp -j DROP

Can anyone offer some advice as to what I'm doing wrong?

UPDATE: I noticed that all offending incoming connections were from port 53, so did the following and it seemed to work:

-A INPUT -s <offending IP> -p udp --dport 53 -j REJECT
share|improve this question

migrated from May 18 '11 at 10:35

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Even if your iptables rule does work, keep in mind that it won't slow down the attackers' UDP rates, since, unlike TCP, the protocol does not react to datagram drops. – PaoloVictor May 16 '11 at 18:23
What are my options to block UDP? There are only 2 IP addresses and I've tried to block them on specific ports as well. Basically netstat tells me they are connecting with port 53 using UDP and my apache server is responding to it (spawns new httpd processes). – Tristen May 16 '11 at 18:42
It seems your problem is solved. Good! Anyway, there's not much you can do to effectively block UDP. Sure, you can always discard the datagrams with iptables or at a router, but it won't slow down the attacker's stream, which means that your inbound link still would be taxed (also, the server still has to received the datagram before deciding to discard it :). On this case, your best bet would be contacting your ISP/Datacenter provider/etc and see if they can block the attacker's traffic before it arrives at your server. – PaoloVictor May 17 '11 at 10:51

With any kind of DoS or DDoS attack, the only real thing you can do is talk to your upstream provider, and have them block the traffic as it hits their network, otherwise it'll still saturate your connections to the internet, and although you're dropping the traffic, you'll likely still have connectivity problems.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.