Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Iptables rules

[gmakhs]

hello im using this rules to block incooming udo flood but it ddoesn't realy stopn anything...

iptables -A INPUT -p udp --dport 27015 --limit 10/s --limit-burst 20 -j Drop

there is any way to use this command on auto block ip way? like if they use more than 20 packets per sec it will block incoming ip?

[jpou]

Try jumping to Log target to see if this rule matches and then from log target jump to Drop.

[jpou]

(Edit not working)...

Try:

iptables -A INPUT -p udp --dport 27015 -m limit --limit 10/s --limit-burst 20 -j Drop

[gmakhs]

Originally Posted by jpou

(Edit not working)...

Try:

iptables -A INPUT -p udp --dport 27015 -m limit --limit 10/s --limit-burst 20 -j Drop

im gonna try but i get a huge flood so cpu pass out.. thats why im looking for an auto block ip

[gmakhs]

its not working.. it still posible to get flooded

[infinitnet]

iptables -A INPUT -p udp -m limit --limit 4/s --limit-burst 5 -j DROP

[gmakhs]

neither this not work if i flood my server with udp packets still goes offline... there isn't any way to block incoming ip when pass the limmits?

[infinitnet]

These rules should actually block all further requests, if they're above 5/sec. You can try a different strategy:

iptables -A INPUT -p udp -m udp -m state --state NEW -m recent --update --seconds 30 --hitcount 10 --name UDPFLOOD --rsource -j DROP
iptables -A INPUT -p udp -m udp -m state --state NEW -m recent --set --name UDPFLOOD --rsource

[gmakhs]

applyed both codes im still able to flood

[gmakhs]

if i block the ip i can't get more flooded from this ip if i block just packets it can still hit me

[gmakhs]

Edit
using this command right i manage to limmit the outgoing udp data . but about ingoing still passing through thats weird becouse im using same rules for both and i only change input /Output

[jpou]

give us your full iptable (iptables -L -n). Since you are appending rules, you might have a rule that accepts all packets before your UDP rate limiting rule kicks in.

[gmakhs]

# Generated by iptables-save v1.3.5 on Mon Feb  6 01:56:49 2012
*mangle
:PREROUTING ACCEPT [59798:12123623]
:INPUT ACCEPT [23894:1338161]
:FORWARD ACCEPT [35900:10784546]
:OUTPUT ACCEPT [15151:3677743]
:POSTROUTING ACCEPT [51051:14462289]
-A INPUT -p udp   -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j DROP
-A INPUT -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j DROP
-A FORWARD -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A FORWARD  -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A OUTPUT -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A OUTPUT  -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A PREROUTING -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A PREROUTING  -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A POSTROUTING -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A POSTROUTING  -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A INPUT -p udp -m udp -m recent --update --seconds 30 --hitcount 10 --name UDPFLOOD --rsource -j  DROP
-A INPUT -p udp -m udp -m recent --set --name UDPFLOOD --rsource
-A FORWARD -p udp -m udp -m recent --update --seconds 30 --hitcount 10 --name UDPFLOOD --rsource -j DROP
-A FORWARD -p udp -m udp -m recent --set --name UDPFLOOD --rsource
COMMIT
# Completed on Mon Feb  6 01:56:49 2012
# Generated by iptables-save v1.3.5 on Mon Feb  6 01:56:49 2012
*filter
:INPUT ACCEPT [8220:397460]
:FORWARD ACCEPT [35900:10784546]
:OUTPUT ACCEPT [15153:3678123]
-A INPUT -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j DROP
-A INPUT -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j DROP
-A FORWARD -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A FORWARD  -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A OUTPUT -p udp -m state --state NEW -m limit --limit 6/sec --limit-burst 10 -j  DROP
-A OUTPUT  -p udp -m state --state ESTABLISHED -m limit --limit 6/sec --limit-burst 10 -j DROP
-A INPUT -p udp -m udp -m recent --update --seconds 30 --hitcount 10 --name UDPFLOOD --rsource -j  DROP
-A INPUT -p udp -m udp -m recent --set --name UDPFLOOD --rsource
COMMIT
# Completed on Mon Feb  6 01:56:49 2012

thats my rules....

and here is iptables l n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           state NEW limit: avg 6/sec burst 10
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           state ESTABLISHED limit: avg 6/sec burst 10
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp recent: UPDATE seconds: 30 hit_count: 10 name: UDPFLOOD side: source
           udp  --  0.0.0.0/0            0.0.0.0/0           udp recent: SET name: UDPFLOOD side: source

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           state NEW limit: avg 6/sec burst 10
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           state ESTABLISHED limit: avg 6/sec burst 10

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           state NEW limit: avg 6/sec burst 10
DROP       udp  --  0.0.0.0/0            0.0.0.0/0           state ESTABLISHED limit: avg 6/sec burst 10

[infinitnet]

Execute the following commands and try it then. The rules are correct, I see no reason why they shouldn't work:

iptables --flush
iptables -N udp-flood
iptables -A udp-flood -p udp -m limit --limit 1/sec -j ACCEPT
iptables -A udp-flood -j DROP
iptables -A INPUT -j udp-flood

[gmakhs]

this drops ssh acces.... im gonna add the ssh accept first