-3

Recently, I have experienced a DoS attack so i decide write a new rule to stop the attack but my knownledge is not enough to do this,

so any hint or help will be appreciated

Attack log attachment-ed below, Also my current tables is attached too

My Rules:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
# Allow LoopBack
-A INPUT -i lo -j ACCEPT

# Allow New Connection Only On Ports ( 22 - 3724 - 3799 ) And Maximum Connection Limited At 15
-A INPUT -i eth0 -p tcp -m multiport --dports 22,3724,3799 -m state --state NEW,ESTABLISHED -m connlimit --connlimit-upto 15 --connlimit-mask 32 --connlimit-saddr -j ACCEPT

# Allow Ping ( Only 2x Ping Per a Sec )
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 2/sec --limit-burst 2 -j ACCEPT

# Allow LoopBack
-A OUTPUT -o lo -j ACCEPT

# Allow Established Connection
-A OUTPUT -o eth0 -p tcp -m multiport --sports 22,3724,3799 -m state --state ESTABLISHED -j ACCEPT

# Allow Ping ( Only 2x Ping Per a Sec )
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 0 -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
COMMIT

Attack Log: http://paste.ubuntu.com/12019024/

Also if my rules need rewrite/edit tell me

Thank you

5
  • Is your server's IP 10.30.70.26 by chance?
    – Oliver
    Aug 7 '15 at 7:00
  • @Oliver, yes that's mine
    – DarkOne
    Aug 7 '15 at 7:15
  • 1
    Writing an iptable rule will usually do nothing to mitigate a DDoS, since the connection TO your server will still be overloaded, which makes your server unreachable for normal traffic.
    – dadriel
    Aug 7 '15 at 7:27
  • 1
    Ok, looks like your server is not the victim but the attacker. I suggest you check what happens on the server rather than losing your time with iptables. Maybe check How to deal with a compromised server
    – Oliver
    Aug 7 '15 at 7:33
  • whole attacker have same mac-address, all those ips are on same machine, I think it called fake ip address
    – DarkOne
    Aug 7 '15 at 9:17
1

According to your log, the SYN packets are originating in your loopback interface and your eth0 is sending SYN ACK in response to a lot of random public IPs. As @Oliver pointed out in the comment above, your server may be compromised. I would remove server off the network and look into how to rectify a compromised server.

http://www.ducea.com/2006/07/17/how-to-restore-a-hacked-linux-server

How do I know if my Linux server has been hacked?

https://major.io/2011/03/09/strategies-for-detecting-a-compromised-linux-server/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.