3

I am under UDP flood attack. I used following protections to solve it:

iptable IP ban:

iptables -I INPUT -s 37.187.231.xxx -j DROP

Tried another iptable syntax

/sbin/iptables -I INPUT -i eth0 -s 37.187.231.xxx -j DROP

Tried to limit the UDP packets:

iptables -A INPUT -p udp -m udp --dport 0:65535 -m state --state NEW -m recent --update --seconds 1 --hitcount 10 --name UDP --rsource -j DROP 

Completely disabled UDP packets:

iptables -A INPUT -p udp -j DROP

All the ports are closed. Below is the output of - netstat -an | grep "udp"

udp        0      0 127.0.0.1:53            0.0.0.0:*
udp6       0      0 ::1:53                  :::*

I have following software installed:

Ubuntu 14.04
UFW Firewall
i7 processor with 16GB Ram

Only port 80 is opened.

I am still being attacked by UDP flood. "sudo iftop -n" command shows heavy MBs input traffic from the IPs I have already blocked using IP tables. Maybe iptables did not block the IPs? If yes then how can I fix it?

  • 1
    What makes you think you're not filtering them? Blocking them with iptables doesn't prevent them from coming down your connection, or showing up on iftop; it only prevents apps on your system from being fed them to process. If you really are being DOSsed, you will need to work with your upstream provider in order to mitigate the traffic. – MadHatter May 13 '15 at 15:40
  • Good question. I am not expert but that is my assumption. sudo iftop -n shows heavy MBs traffic from the IPs that I have already banned using iptables. So that person is still sending loads of traffic on my server? Is there a better way to block an IP permanently? – Niky May 13 '15 at 15:44
  • Hi, IPTables will be an stressful solution because you must block one by one the IP addresses attackers, but the attacker can change his IP address as much as he can, Do you accept another option for a solution? – ravasquezgt May 13 '15 at 15:46
  • 2
    I don't think you're quite getting my point. In all likelihood, you are blocking the traffic. But that doesn't stop people from sending it to you; that is not something you can achieve from where you are. You will need to work with your hosting provider to get them to stop passing the traffic to you, if it's overwhelming your connection. – MadHatter May 13 '15 at 15:47
  • 1
    @TeroKilkanen thanks, Tero: I guess I wasn't making that point clearly enough! – MadHatter May 13 '15 at 16:13
6

As I and others are telling you above, blocking traffic with iptables doesn't prevent it from reaching your server; it only stops your server from processing it. If the sheer volume of traffic is saturating your server's connection, and causing you to lose connectivity to it, you have no choice but to work with your hosting provider, to have them filter out this traffic before it reaches the pipe (virtual or physical) to your server.

If your provider is unwilling or unable to do this, then you've just found a good reason to migrate to a better provider.

  • Thanks for the answer. It saved a lot of my time :) Now I can look for other hosting providers. – Niky May 13 '15 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.