0

I've been hosting game-servers since a long time and I keep updating my iptables firewall time and again to block most attacks. One of my game-server port is being flooded with "SSDP" requests and my game-server replies to that with a "disconnect" packet.

Here is how the stream is established coming from Source Port 1900 while the destination is my game-server port,

http://paste.ubuntu.com/8099734/

I have the following iptables configuration that should have been blocking the outgoing "disconnect" packets but it's not working anymore and I have no idea why.

http://paste.ubuntu.com/8099779/

I have temporarily blocked input from UDP source-port 1900 but that is not a good enough solution as my game-server is vulnerable to many other packets so the outgoing "disconnect" packet is something that has to be blocked.

I'm not sure if -m multiport match might be required to block this?

  • SSDP packets shouldn't even be happening unless your game server's not on its own network (i.e, you're doing this at home). SSDP is used almost exclusively by UPnP discovery. – Nathan C Aug 20 '14 at 18:09
  • It's not at home. It's actually a flood I'm getting with 100 different IP Addresses on my dedicated server. And that is how my game-server is replying to those packets. Maybe it's a new way to generate an application specific flood. – John Elvy Adam Aug 20 '14 at 18:18
2

I notice that what you are receiving looks like a reply package, not a request.

So most likely this is an amplification type attack, where they send a small request to SSDP enabled devices on the net, but with your IP spoofed as originator. So when all these devices send their reply, you get 'em.

As an added side effect, your service has no idea what they are talking about and have no choice but to "disconnect" them (which the game server apparently does by sending the text disconnect).

I dont understand why you are targeting your reply to this. Id try going for the incoming package instead, with something like:

iptables -I INPUT -p udp --dport 16000:29000 -m string --to 75 --algo bm --string 'HTTP/1.1 200 OK' -j DROP

  • I also thought of doing something like that but this is just a specific case. Sometimes my game-server also responds to various other type of packets with a "disconnect" packet. I want to block them all together. Why won't that work? @thelogix – John Elvy Adam Aug 20 '14 at 18:51
  • Im just thinking that the "disconnect" message must be there for a reason and removing it may cause trouble in some scenarios. But thats just a guess ofcourse. I'll re-examine your iptables.. Hang on. – thelogix Aug 20 '14 at 18:55
  • No your '-A OUTPUT -p udp --sport 16000:29000 -m string --algo bm --string "disconnect" -j DROP' should work. There nothing "accepting" the package ealier, so i dont know why it doesnt. My guess is that one of the conditions arent met. Like, the source port isnt within the range or table should be FORWARD instead. You can do 'iptables -L -n -v' and see how many packages that hit the rule, to maybe tell you whats happening. – thelogix Aug 20 '14 at 19:06
  • The rule did work fine before but since the SSDP it stopped working. I've no idea why. The port is 20380 so it should be in range. Maybe I should reformat it to something like "-A OUTPUT -p udp -m udp --match multiport --sports 16000:29000 -m string --algo bm --string "disconnect" -j DROP"? – John Elvy Adam Aug 21 '14 at 11:51
  • Sure try it. It cant hurt. I've also been thinking that it may be something like "recent" or "established/related" that could have the packages invisibly accepted, but i cant really find it. – thelogix Aug 21 '14 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.