One of my servers is under constant UDP DDOS attack. ~500Mb/s and 700k PPS. I have a 10Gbit downlink so that is not the bottleneck.
In my IPTABLES I have created a 'whitelist' via ipset and dropping all other traffic that tries to reach my game server.
The ipset set has ~2000 IP addresses and 10 CIDR rows in it. Type of set: netash
Table: RAW
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 match-set allowip src
DROP udp -- 0.0.0.0/0 135.x.x.x udp dpt:30120
This worked very well until the PPS of the attacks started in increase.
While the server is still up and not lagging, IPTABLES seems to have a hard time processing the whitelisted IP's among this high packet count during the attack. 50% of the players are getting connection issues in-game even when their IP is whitelisted in the allowip ipset list. CPU usage is also not crazy high.
Is this some kind of limitation of the max PPS in iptables? Or can I do something to speed up?
Thanks!