Tagged Questions

0
votes
1answer
43 views

Parse Apache logfile and ban IPs

My server is under attack, it is flooded with request with the following pattern: Thousands of IPs Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
-1
votes
1answer
63 views

Any way to Improve performance of iptables DDOS whitelist? [closed]

I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
2answers
58 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
3answers
146 views

iptables rule to stop DDOS

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
3
votes
1answer
51 views

iptables, what to open on INPUT for wget

I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
2
votes
1answer
175 views

How do I drop “empty” HTTP packets using iptables?

I have a 1GB-VPS-hosted site running on Ubuntu 10.04 LTS. I am using nginx as the web server. The site has been running in a relatively stable configuration for three years, and handles about 4 ...
0
votes
2answers
193 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
0
votes
2answers
104 views

netfilter ip_conntrack and (d)DoS

Does using netfilter.ip_conntrack in the kernel in anyway help mitigate (d)DoS attacks or does it make it worse? I know it adds the ability to track connections and such but just curious if it helps ...
0
votes
1answer
170 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
0
votes
0answers
82 views

Website slowed down, possible DDOS attack

I'm facing a big problem today. My website is very slow. I've tried everything and nothing helped. I disabled mysql and my website was still slow loading a static page. I also restarted the server. I ...
3
votes
1answer
185 views

iptables - drop all HTTP(S) traffic but from CloudFlare

I would like to allow only HTTP(S) traffic coming from CloudFlare. In that way attackers cannot attack the server directly. I know CloudFlare is not mainly a DDoS mitigator, but I would like to try ...
1
vote
0answers
51 views

Effective ways of mitigating Spoofed Syn Flood with iptables [duplicate]

Possible Duplicate: SYN Flood Advice Heyo, Been dealing alot with spoofed syn floods lately. Are there any tips or tricks we could do to better survive them? Syn Cookies are already ...
0
votes
1answer
347 views

*Simple* way to block DDoS by number of requests

I have 3 Varnish 3.0.2 servers with Apache 2 as backends, which are being load balanced through a HAproxy separate server. I need to find a very simple program (I'm not much of a sysadmin), which ...
0
votes
4answers
576 views

How to tune Linux kernel to withstand DDoS? (HAProxy)

Please do not reply with "this is not possible", as it's waste of time. I am developing cloud appliance and I have a valid reason to protect this layer against DDoS, and there are few companies doing ...
1
vote
1answer
193 views

DROP vs REJECT DDoS

I asked somewhere else, and I got this response: Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine ...
-4
votes
3answers
2k views

iptables rules to counter the most common DoS attacks? [closed]

Recently I've got a lot of small scale DoS attacks. I am wondering what iptables rules should I use to counter the most common DoS attacks, and generally secure my web server. The web server sports ...
0
votes
1answer
287 views

Debian iptables, netstate. DDOS?

My server has been timing out and crashing lately. I ran this command: netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n Check the picture for result. ...
0
votes
1answer
290 views

DDos attack filter

Im running a debian linux VPS server with a garrysmod server. Today I've recieved a ddos attack and I could log by using tshark the next: 4.213248 91.204.63.5 -> 176.58.101.xx UDP Source port: ...
0
votes
3answers
456 views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
-1
votes
2answers
477 views

DDOS Attacks Explanation [closed]

I have some questions regarding the ddos attacks and how it really works , i really need some good explanation for it as i can't find any good reference that can help me . Questions : what are the ...
1
vote
1answer
76 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
1
vote
0answers
109 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
0
votes
2answers
1k views

How to block tcp-reset with iptables to combat DDoS attacks?

I have someone flooding me with random packets on random ports that are closed. My server is responding to this with tcp-reset packets I think which is chewing up the outbound bandwidth too. How do ...
0
votes
4answers
503 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
1answer
293 views

Iptables recent module

iptables -A INPUT -p udp -m state --state NEW -m recent --set --name alimit --rsource iptables -A INPUT -p udp -m state --state NEW -m ...
1
vote
1answer
333 views

Amazon EC2 abuse

I am using amazon 85 ec2 instances. Day before yesterday got emails from AMAZON for AMAZON EC2 abuse. it says about the DOS attacks on remote host. Amazon mail content attached for your reference. ...
0
votes
2answers
214 views

Locating Source of Inbound DDOS

Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS. Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec). In the ...
0
votes
1answer
420 views

(D)DOS Deflate Bug/Alternative

Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
4
votes
2answers
3k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
2
votes
2answers
559 views

DoS attack requesting single file on server, best way to overcome?

My server's currently being pounded by a large DoS, had to move away from Apache and push everything onto Nginx (rewrites are a nightmare!). Sample from the access log: 186.92.86.149 - - ...
1
vote
1answer
247 views

Restrict number of parallel connections on Apache server

I'm on an Ubuntu server running Apache2. I would like to protect myself against (d)dos and syn flood attacks and therefore try to limit the number of parallel connections per client IP. I've heard ...
0
votes
2answers
236 views

What is the main difference between iptables and EC2's “security groups”?

If I block traffic via a security group, I assume I don't have to pay for it. But if I block traffic via iptables installed on my server then I assume it would be me that pays for any incoming ...
2
votes
1answer
506 views

Fighting DDoS Attack, looking for some advice

So, it appears about 2 IP addresses are overloading my HTTP server (apache) over UDP and I am unable to stop this using IP Tables. I am using CentOS 5. I managed to block some other IP addresses that ...
0
votes
1answer
146 views

Single IP attack or other issue?

Description of incident: I notice in my MRTG panel that httpd processes have climbed to 800 ( our maximum ), but all other parameters are normal ( cpu, memory, traffic ) I immediately ran a nestat ...
1
vote
1answer
120 views

Firewalling all incoming traffic with custom rules

How do you automatically block all incoming traffic by creating custom rule for every connection (in real time) using iptables? To clarify - the situation is that my linux box is being DDOSed via ...
0
votes
2answers
126 views

Don't allow a host to be spammed

I run a proxy server with squid and I've just got a report that a user of mine tried a ddos using my proxy. I can I block such requests? Ex: Allow just max 5 requests on the same domain on the same ...