0

One of my server providers reports me a server of mine generating suspicious traffic to other IP addresses. I think my server using a DDOS bot and i couldn't find the source of the problem. So I stopped all of my services nginx/supervisord/elasticsearch etc. It's not solved my problem and i disabled all traffic over iptables. now my server only accept ssh connections. There are lots of files in the server approx. 1.8TB and i want to move them to a DigitalOcean spaces instance.

The problem starts here i couldn't achieve allow digitalocean's IP addresses on ip tables.

Here is my snippet:

# Allow loopback
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Allow DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

# Now, allow connection to website serverfault.com on port 80
iptables -A OUTPUT -p tcp -d ams3.digitaloceanspaces.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d ams3.digitaloceanspaces.com --dport 433 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop everything
iptables -P INPUT DROP
iptables -P OUTPUT DROP

after adding these rules i couldn't reach ams3.digitaloceanspaces.com with curl or anything.

I'll move the files and shut down the server for good. Can you tell my what am i missing in my iptables rules ?

4
  • requests may be coming from / going to a different subdomain other than ams3.digitaloceanspaces.com, are you sure ams3.digitaloceanspaces.com is the correct destination / source? Feb 20, 2019 at 17:37
  • actually im not sure about forwarding. when i apply these rules i can see DO's IP address on the iptables -nvL output. but i'll try to allow IP range of the domain Feb 20, 2019 at 17:45
  • i've change the domain rule to iptables -A INPUT -i eth1 -m iprange --src-range 5.101.104.0-5.101.111.255 -j ACCEPT and it didn't solve my problem too. Feb 20, 2019 at 17:53
  • did you check traceroute <IP> command, it will show you if your requests are being blocked by your firewall Feb 21, 2019 at 18:06

0

You must log in to answer this question.

Browse other questions tagged .