Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our datacenter has recommended we block all RIPE IP Addresses on one of our machines. It is constantly being DDoS Attacked everytime the null routes are lifted, so I am not sure how this would help, but am more than willing to try anything now.

I couldn't find much information on it from a Google search, but how can we block all RIPE IP Ranges? Preferably I wouldn't even mind blocking all Ranges that were not US Based since that is the only target we traffic, but this is probably too difficult.

share|improve this question
It's not clear what you mean. Do you mean to drop them at the server? Unless the problem is that you're replying to them, how would that help? They'll still consume the same amount of inbound bandwidth? – David Schwartz Nov 20 '11 at 23:59
Yeah dropping them at the server. Game Servers run on this machine, so this would stop the attackers being able to query them to see if they are running. Atleast, that is my assumption as to why this was suggested to us by the DC. – Brett Powell Nov 21 '11 at 0:05
Game servers? Like.. UT2k4? This (and a bunch of other) server has a vulnerability in the query protocol that allows it to be used for DRDOS attacks. There's no real way to can block these, and there's really not a whole lot you can easily do. – devicenull Nov 21 '11 at 0:24
Game Servers like all srcds games, etc. The actual machines are being DDoS attacked, not the exploit allowing the game servers to be turned into a DDoS attacker. – Brett Powell Nov 21 '11 at 0:57
up vote 1 down vote accepted

You have two choices. You can block the incoming packets or you can block the replies. Generally, it's more efficient to block the replies because you can just do that with a route. But you can filter the inbound packets in your firewall.

Here are the networks you need to block, arranged as CIDR blocks:

2/8, 5/8, 24/8, 31/8, 37/8, 46/8, 62/8, 77/8, 78/7, 80/7. 82/8, 83/8, 84/6, 88/7, 90/8, 91/8, 92/6, 109/8, 128/6, 132/8, 134/7, 136/6, 140/7, 143/8, 144/4, 160/5, 168/6, 176/8, 178/8, 185/8, 188/8, 192/6, 196/8, 198/7, 212/7, 217/8.

Triple check everything!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.