3

I am using a Debian 6 - 64bit OS and my server is ddosed/flooded through udp protocol from time to time. I basically host game-servers and my firewall is set to rate-limit the packets on allowed ports but sometimes the rate per IP is low but the number of IPs are more so my server sends outgoing icmp unreachable replies to the attacking IP which does no benefit but chokes/saturates the port even more.

I'm looking on how to disable this feature. Actually the ports that get attacked are allowed through firewall and I can't disable them although it would solve the issue. I run a number of servers over some port ranges so I can't continually keep accepting these ports one by one and decided to allow the total port range I might require.

I'm looking at some kernel ability to stop this?

7

To prevent ICMP unreachable packets being sent, you can drop them using netfilter (iptables):

iptables -I OUTPUT -p icmp --icmp-type destination-unreachable -j DROP

Better is to prevent them being generated in the first place by using the DROP target on the INPUT traffic, rather than REJECT (or nothing where the kernel networking stack will create the unreachable reply rather than netfilter)

I don't think this will resolve your issues though; you need to identify what impact the DDoS is having; is it saturating the network or consuming system resources (CPU/memory etc). If it's network, then muting the replies may assist slightly, but you're still going to have the incoming packets on the wire.

  • I tried that already but as you indicated already, they are still coming out of the kernel and dropped at the filter which does nothing but slows down the CPU although that's not a problem for me because network port is what gets saturated, nothing else. – Asad Moeen Jul 12 '13 at 8:00
  • 1
    If it is the wire that is being saturated, then you will need to work with your upstream provider, since once the packets reach your box, it's too late for you to be able to do anything. – fukawi2 Jul 12 '13 at 22:41
4

The iptables target REJECT causes ICMP unreachable responses to be sent. Changing your target over to DROP will cause the incoming packets to be silently black-holed.

  • I already have the drop on the input packets. But I'll try to be clear, I have accepted a port range say 20500:30000 and rest are blocked. I use ports for servers within this range with an increment of 10 so it means that 9 out of every 10 ports are open within the range. So I'm looking at some kernel ability to drop it. – Asad Moeen Jul 12 '13 at 7:58
  • As far as I can tell my looking thru the Linux 2.6 kernel source the kernel will generate ICMP unreachable messages for any traffic that it receives to ports without bound listening sockets. If you don't DROP the packets it'll generate unreachables. If you have ports you ACCEPT traffic for but nothing listening on those ports then the kernel is going to receive those requests and respond. I don't see any global flag referenced in the source to disable the kernel sending unreachables. I think you're going to have to tighten up your rules and exclude those ports that don't have bound listeners. – Evan Anderson Jul 12 '13 at 8:38
  • Since I don't find problems with CPU usage, I guess I should disable outgoing ICMP unreachable requests. – Asad Moeen Jul 12 '13 at 9:38

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.