2

One of my servers is under constant UDP DDOS attack. ~500Mb/s and 700k PPS. I have a 10Gbit downlink so that is not the bottleneck.

In my IPTABLES I have created a 'whitelist' via ipset and dropping all other traffic that tries to reach my game server.

The ipset set has ~2000 IP addresses and 10 CIDR rows in it. Type of set: netash

Table: RAW

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            match-set allowip src
DROP       udp  --  0.0.0.0/0            135.x.x.x            udp dpt:30120

This worked very well until the PPS of the attacks started in increase.

While the server is still up and not lagging, IPTABLES seems to have a hard time processing the whitelisted IP's among this high packet count during the attack. 50% of the players are getting connection issues in-game even when their IP is whitelisted in the allowip ipset list. CPU usage is also not crazy high.

Is this some kind of limitation of the max PPS in iptables? Or can I do something to speed up?

Thanks!

Improve this question
5
  • Please add, for completeness: which type of the set and how many addresses in it?
    – Nikita Kipriyanov
    Jan 13, 2021 at 10:47
  • 1
    ipset create allowip nethash, 1900 IP addresses in this set. I'm btw dropping the packets in the RAW PREROUTING table/chain.
    – jordy
    Jan 13, 2021 at 11:16
  • Do you have an unusually large amount of legitimate traffic from any of those networks? If so, it may be helpful to place those in a separate ipset that is checked first.
    – Michael Hampton
    Jan 13, 2021 at 20:28
  • No all players use about the same amount of traffic.
    – jordy
    Jan 13, 2021 at 21:55
  • You could do benchmarks compared to nftables + a set. nftables can hook to a NIC in the netdev family which happens earlier in the packet's life than iptables' raw, so maybe you get less overhead in the end.
    – A.B
    Jun 15, 2021 at 15:12

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .