Iptables block future connections

Rade Ilijev

11/14/23, 1:33 AM

I have a problem with DDoS attacks on my game server. It's not an regular ddos attack that will attack directly the machine, but it's attacking a port with many IP addresses (UDP protocol). So, I have developed a function with Python that will recognize incoming ddos attack, but I cannot block every incoming ip separately.

So my question is... how can I block all incoming requests to the specific port (ex. 27022) and still not block connected ones?

2 + 1

networking

linux

iptables

jabbson

11/14/23, 4:38 AM

Since this is UDP, existing connections don't have "state" to make us of in order to distinguish existing connections from the new ones

Score:0

Server

LeeM

11/14/23, 7:14 AM

If there is a specific log file that your python function is targeting to identify these DDOS attempts, it's worth looking at Fail2Ban to dynamically drop "bad" UDP connections. It updates iptables based on the matching criteria you define.

Pretty much any log that identifies the IPs you potentially want to drop can be used a source. You create complex rules like (in simple language): "three 'short packet UDP' connections from [IP] in 5 minutes = Drop for 15 minutes"

Here's an example where someone's using kern.log to identify UDP 'short packets'. The highest-ranked answer shows an example regex and guidance on how to test the drop rule with Fail2Ban.

Fail2Ban might potentially replace your python function completely. Or, if the function is doing something that's more complex than what you can assemble through regexes and the Fail2Ban rule set, if the function outputs to a file, that in turn can be used as a source.

+ 0

Score:0

Server

Stickman

11/18/23, 8:27 PM

You can create a temporary whitelist that is a dictionary for your python app with the clients already connected.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Iptables block future connections

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.