I am getting a synflood on my server port 80 and i cannot stop it. first i got tables full then i disabled iptables to find out that its a synflood
netstat -n | grep :80 |wc -l #returns 1300 - 2000 netstat -n | grep :80 | grep SYN |wc -l #returns around 250
the IPs are coming from everywhere so i suppose its spoofed. when i put in different iptable rules it either doesnt do anything or just drops all connections even the normal ones
this is my sysctl -p
net.ipv4.ip_forward = 0 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.default.accept_source_route = 0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_syncookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = 68719476736 kernel.shmall = 4294967296
what can i do? i am at 1and1 and i dont think they will put in TCP intercept for me which i heard is the best solution. what is really the best solution?