0

I've been hosting game-servers since a long time and I keep updating my iptables firewall time and again to block most attacks. One of my game-server port is being flooded with "SSDP" requests and my game-server replies to that with a "disconnect" packet.

Here is how the stream is established coming from Source Port 1900 while the destination is my game-server port,

http://paste.ubuntu.com/8099734/

I have the following iptables configuration that should have been blocking the outgoing "disconnect" packets but it's not working anymore and I have no idea why.

http://paste.ubuntu.com/8099779/

I have temporarily blocked input from UDP source-port 1900 but that is not a good enough solution as my game-server is vulnerable to many other packets so the outgoing "disconnect" packet is something that has to be blocked.

I'm not sure if -m multiport match might be required to block this?

2
  • SSDP packets shouldn't even be happening unless your game server's not on its own network (i.e, you're doing this at home). SSDP is used almost exclusively by UPnP discovery.
    – Nathan C
    Aug 20, 2014 at 18:09
  • It's not at home. It's actually a flood I'm getting with 100 different IP Addresses on my dedicated server. And that is how my game-server is replying to those packets. Maybe it's a new way to generate an application specific flood. Aug 20, 2014 at 18:18

1 Answer 1

2

I notice that what you are receiving looks like a reply package, not a request.

So most likely this is an amplification type attack, where they send a small request to SSDP enabled devices on the net, but with your IP spoofed as originator. So when all these devices send their reply, you get 'em.

As an added side effect, your service has no idea what they are talking about and have no choice but to "disconnect" them (which the game server apparently does by sending the text disconnect).

I dont understand why you are targeting your reply to this. Id try going for the incoming package instead, with something like:

iptables -I INPUT -p udp --dport 16000:29000 -m string --to 75 --algo bm --string 'HTTP/1.1 200 OK' -j DROP

18
  • I also thought of doing something like that but this is just a specific case. Sometimes my game-server also responds to various other type of packets with a "disconnect" packet. I want to block them all together. Why won't that work? @thelogix Aug 20, 2014 at 18:51
  • Im just thinking that the "disconnect" message must be there for a reason and removing it may cause trouble in some scenarios. But thats just a guess ofcourse. I'll re-examine your iptables.. Hang on.
    – thelogix
    Aug 20, 2014 at 18:55
  • No your '-A OUTPUT -p udp --sport 16000:29000 -m string --algo bm --string "disconnect" -j DROP' should work. There nothing "accepting" the package ealier, so i dont know why it doesnt. My guess is that one of the conditions arent met. Like, the source port isnt within the range or table should be FORWARD instead. You can do 'iptables -L -n -v' and see how many packages that hit the rule, to maybe tell you whats happening.
    – thelogix
    Aug 20, 2014 at 19:06
  • The rule did work fine before but since the SSDP it stopped working. I've no idea why. The port is 20380 so it should be in range. Maybe I should reformat it to something like "-A OUTPUT -p udp -m udp --match multiport --sports 16000:29000 -m string --algo bm --string "disconnect" -j DROP"? Aug 21, 2014 at 11:51
  • Sure try it. It cant hurt. I've also been thinking that it may be something like "recent" or "established/related" that could have the packages invisibly accepted, but i cant really find it.
    – thelogix
    Aug 21, 2014 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .