I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in iptables, but none of them seemed to work. I'm on a 100mbps bandwidth tariff, but the flood i receive is 500+mbps. This is the log of the latest tcpdump -> http://pastebin.com/HSgFVeBs Packet length varies throughout the day. Only my gameserver ports are being flooded - 27015, 27016, 27018 via UDP packets. Are there any iptables rules, that might prevent this?
The only iptable rules that would help you even remotely would be dropping all traffic coming in on those ports. The problem with that is that your service will go down as well. The only thing you can do is talk to your ISP and ask them to drop all incoming udp traffic before it reaches you.
If you have a separate (or separated) means of game users to login with (not by UDP), you can leave all UDP ports denied, and set up a means to dynamically allow the source addresses of logged in users. As Lucas Kauffman said, your would need to do this upstream to avoid your link from being saturated. It would be even more complex to arrange for the upstream to let you do dynamic allows on the logged in source hosts. You'd probably need to run your own router (that can handle 500mbps of attack) that you can engage dynamic filtering on.