1

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan.

I've added the iptables

Chain            num   pkts bytes target     prot opt in     out     source               destination         
DENYIN           400      0     0 DROP       all  --  !lo    *       37.59.4.76           0.0.0.0/0           
DENYOUT          216      0     0 DROP       all  --  *      !lo     0.0.0.0/0            37.59.4.76
PREROUTING       439      0     0 REDIRECT   tcp  --  !lo    *       37.59.4.76           0.0.0.0/0           multiport dports 80,2082,2095 redir ports 8888
PREROUTING       440      0     0 REDIRECT   tcp  --  !lo    *       37.59.4.76           0.0.0.0/0           multiport dports 21 redir ports 8889

Event after a restart, the connection still persists.

 PID USER     PROGRAM                                  SENT      RECEIVED       
  ?  root     37.59.4.76:31108-62.212.77.240:39583     0.000     31.219 KB/sec

What can I do to counter this attack?

2
  • Can you elaborate on DENYIN / DENYOUT chains content ? Oct 30 '14 at 18:02
  • @XavierLucas It's not necessary anymore - my provider found a solution.
    – Hedam
    Nov 1 '14 at 18:56
1

if its destroying your dataplan you have to work with your provider. There is nothing a firewall can do as your provider sees the traffic coming to you anyway. If it hasn't sent anything back that tells me your firewall is probably working as its dropping the packets and not sending back a reject or such.

So ya work with your provider. Give them logs and tell them what is happening.

3
  • I will contact my provider and see what they can do.
    – Hedam
    Oct 29 '14 at 12:46
  • My provider found a bug in their system, causing all this traffic. They've issued a non surcharge order for my account in October and will be fixing the bug soon.
    – Hedam
    Nov 1 '14 at 18:56
  • glad you got to the bottom of it
    – Mike
    Nov 1 '14 at 21:44
1

I don't know your iptables command but normally something like this:

iptables -A INPUT -s 37.59.4.76 -j DROP
1
  • That did not solve the issue.
    – Hedam
    Oct 29 '14 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.