This question already has an answer here:
- I am under DDoS. What can I do? 4 answers
So, it appears about 2 IP addresses are overloading my HTTP server (apache) over UDP and I am unable to stop this using IP Tables. I am using CentOS 5. I managed to block some other IP addresses that were overloading TCP, but can't seem to stop the UDP.
I've narrowed down the offenders to connecting to random ports using UDP connections, but the following entry in iptables isn't working:
-A INPUT -s <offending IP> -p udp -j DROP
Can anyone offer some advice as to what I'm doing wrong?
UPDATE: I noticed that all offending incoming connections were from port 53, so did the following and it seemed to work:
-A INPUT -s <offending IP> -p udp --dport 53 -j REJECT