One of my server providers reports me a server of mine generating suspicious traffic to other IP addresses. I think my server using a DDOS bot and i couldn't find the source of the problem. So I stopped all of my services nginx/supervisord/elasticsearch etc. It's not solved my problem and i disabled all traffic over iptables. now my server only accept ssh connections. There are lots of files in the server approx. 1.8TB and i want to move them to a DigitalOcean spaces instance.
The problem starts here i couldn't achieve allow digitalocean's IP addresses on ip tables.
Here is my snippet:
# Allow loopback
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow SSH
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# Allow DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
# Now, allow connection to website serverfault.com on port 80
iptables -A OUTPUT -p tcp -d ams3.digitaloceanspaces.com --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -d ams3.digitaloceanspaces.com --dport 433 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Drop everything
iptables -P INPUT DROP
iptables -P OUTPUT DROP
after adding these rules i couldn't reach ams3.digitaloceanspaces.com
with curl or anything.
I'll move the files and shut down the server for good. Can you tell my what am i missing in my iptables rules ?
iptables -nvL
output. but i'll try to allow IP range of the domainiptables -A INPUT -i eth1 -m iprange --src-range 5.101.104.0-5.101.111.255 -j ACCEPT
and it didn't solve my problem too.