i have massive attack on port in my server

Question

i have Ubuntu 15.4 server i open a port with number 20000 i got massive ddos attack on this port i typed in terminal

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

to catch the attacker ip and block it i found bazillion ip's with opened connection 55

i need to create automatic script using iptables to protect that port

so if ip have connection more than 5 iptable block it automatically using

iptables -A INPUT -s attacker ip address -j DROP

but i dont know how to do that script it will take forever to block the ips one by one :)

Doug Smythies · Accepted Answer · 2016-08-28T00:47:41.407

0

The following will detect the IPs and then drop them for more than a day.

# Dynamic Badguy List. Detect and DROP Bad IPs that try to access port 20000.
# Once they are on the BADGUY list then DROP all packets from them.

iptables -A INPUT -i eth0 -m recent --update --hitcount 5 --seconds 90000 --name BADGUY -j LOG --log-prefix "Port 20000 BAD:" --log-level info
iptables -A INPUT -i eth0 -m recent --update --hitcount 5 --seconds 90000 --name BADGUY -j DROP
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 20000 -m recent --set --name BADGUY -j ACCEPT

Replace eth0 with your actual interface name.
Place these rules after your ESTABLISHED,RELATED by-pass rule. A typical example:

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

edited Aug 28 '16 at 00:47

answered Aug 27 '16 at 14:45

Doug Smythies

15,448
5
44
61

i just add the rules ? or i have run them with cron job ? – Vlark.Lopin Aug 27 '16 at 21:51
Just add the rules. – Doug Smythies Aug 28 '16 at 00:09
i have main eth0 and other ip failover with eth0:0 and eth0:1 can i apply this rules on all of them ? – Vlark.Lopin Aug 29 '16 at 03:42
You can not apply iptables rules using aliased interface names. So, I would guess that you would apply somehow using eth0. – Doug Smythies Aug 29 '16 at 05:03
i added this rule first iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT then added the rest rules i see attack reduced – Vlark.Lopin Aug 29 '16 at 20:51
If you are getting too many log entries, then you can delete the logging rule. I have the logging rule because I study this stuff. – Doug Smythies Aug 29 '16 at 23:20
is this working on new connection too ? – Vlark.Lopin Aug 30 '16 at 04:49
Once the hitcount has been triggered, yes it works on all subsequent NEW connections. – Doug Smythies Aug 30 '16 at 14:49

i have massive attack on port in my server

1 Answers1

Linked