I need a little help dealing with ddos. I'm experiencing 1gb ddos attack on my server and I don't know how to stop it. (1gbs is the maximum speed of the server.)  I've the following iptables rules:   iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT  iptables -A INPUT -p tcp --dport 22 -j ACCEPT  iptables -A INPUT -p tcp --dport 80 -j ACCEPT  iptables -A INPUT -p tcp --dport 8080 -j ACCEPT  iptables -A INPUT -i lo -j ACCEPT  iptables -A INPUT -j DROP   however with tcpdump I can see packets coming from from port 53  12:14:40.341410 IP 195.137.162.149 &gt; x.x.x.x: ip-proto-17 12:14:40.341411 IP 193.169.188.52.53 &gt; x.x.x.x.23495: 23454- 0/4/6 (234) 12:14:40.341414 IP 195.248.88.120 &gt; x.x.x.x: ip-proto-17 12:14:40.341416 IP 193.19.184.42.53 &gt; x.x.x.x.50529: 26701| 6/0/1 TXT[|domain] 12:14:40.341418 IP 192.41.13.71.53 &gt; x.x.x.x.10634: 23454| 6/0/1 TXT[|domain] 12:14:40.341418 IP 50.97.53.214.53 &gt; x.x.x.x.65437: 23454| 6/0/1 TXT[|domain] 12:14:40.341419 IP 192.3.130.149.53 &gt; x.x.x.x.57519: 24820| 6/0/1 TXT[|domain] 12:14:40.341438 IP 195.182.58.136 &gt; x.x.x.x: ip-proto-17 12:14:40.341441 IP 193.234.216.12 &gt; x.x.x.x: ip-proto-17 12:14:40.341442 IP 195.228.85.145.53 &gt; x.x.x.x.7903: 37969| 6/0/1 TXT[|domain] 12:14:40.341512 IP 192.195.177.60.53 &gt; x.x.x.x.42871: 57501- 0/13/23 (718) 12:14:40.341552 IP 192.210.150.10.53 &gt; x.x.x.x.41447: 25994| 6/0/1 TXT[|domain] 12:14:40.341556 IP 193.28.177.41 &gt; x.x.x.x: ip-proto-17   iptables -xnvL  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)     pkts      bytes target     prot opt in     out     source               destination            415575 293176304 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state ESTABLISHED    24101  1323153 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80    19725  1182436 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080        2      104 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            13101233 35329988490 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0             Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)     pkts      bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 488686 packets, 518540789 bytes)     pkts      bytes target     prot opt in     out     source               destination         in nginx i've  limit_req_zone  $binary_remote_addr  zone=one:10m   rate=5r/s;   in this screenshot you can see the actual numbers. my normal usage is no more than 5mb/sec.   netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n | tail | grep -v "127.0.0"   13 87.149.x.x  14 95.68.x.x  15 109.186.x.x  15 84.108.x.x  15 91.231.x.x  17 162.17.x.x  18 82.212.x.x  82 151.248.x.x  94 79.180.x.x
2444
This is a  about DoS and DDoS mitigation.   I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all 100Mbps of my available bandwidth.  Nobody can access my site because all the requests time out, and I can't even log into the server because SSH times out too!  This has happened a couple times before, and each time it's lasted a couple hours and gone away on its own.  Occasionally, my website has another distinct but related problem: my server's load average (which is usually around .25) rockets up to 20 or more and nobody can access my site just the same as the other case.  It also goes away after a few hours.  Restarting my server doesn't help; what can I do to make my site accessible again, and what is happening?  Relatedly, I found once that for a day or two, every time I started my service, it got a connection from a particular IP address and then crashed.  As soon as I started it up again, this happened again and it crashed again.  How is that similar, and what can I do about it?
44086
I've noticed an IP address today on my network (192.168.15.1) which when visited actually goes to a page that has a router webconfig page (Not my router)  The puzzling thing is that i tried traceroute 192.168.15.1 which said that the distance between me and that host is 9 hops, whereas the distance between me and any other computer on my home network is 2 hops away (My computer --> Router --> Host)   Can someone please explain what's going on here ?  tracert output:  Tracing route to 192.168.15.1 over a maximum of 30 hops    1    &lt;1 ms    &lt;1 ms    &lt;1 ms  192.168.1.1   2    47 ms    51 ms    49 ms  [163.121.171.123]   3     *        *        *     Request timed out.   4   128 ms     *        *     163.121.211.134.dnet.net [163.121.211.134 ]   5     *      134 ms   126 ms  10.37.242.18   6    94 ms    90 ms    95 ms  10.35.2.157   7   178 ms   254 ms   206 ms  10.32.8.107   8    85 ms    57 ms   318 ms  10.35.0.186   9   215 ms   241 ms   230 ms  192.168.15.1  Trace complete.
40099
I have this rule in my iptables:  iptables -A INPUT -s 192.168.11.0/24 -j LOG   My question is:  Where is the iptables log file, and how can I change that?
95431
My question is how to trap traffic going to 202.20.20.20 (The website IP/any dynamic input of website) and redirect to 192.168.1.10
99149
When I type mynewdomain.com into my browser I believe the following happens.   My computer sends a request to my ISP's name servers to find the IP address of mynewdomain.com My ISP name server sends a request to the "." name server. The "." sends a response back to the ISP name server, saying try using the com. nameserver. My ISP name server sends a request to the com. nameserver. The com. nameserver finds mynewdomain.com. and sends my ISP nameserver back the A record. My ISP nameserver sends this back to my computer.    My question is about step 5. How does mynewdomain.com. get into the list on the com. nameserver? And given that there are hundreds of millions of registered .coms, how does it find mine in such a short time?
27568
When running netstat -a on my local machine, i see ports on the 0.0.0.0 address listening.    I would assume that 0.0.0.0 is my local machine, except that i also see 127.0.0.1 listening to specific ports.  What is the 0.0.0.0 address?  What is the difference between 0.0.0.0 and 127.0.0.1?  Below is an example of the output:  Proto  Local Address          Foreign Address        State TCP    0.0.0.0:445            MyComputer1:0          LISTENING TCP    0.0.0.0:49156          MyComputer1:0          LISTENING TCP    0.0.0.0:49157          MyComputer1:0          LISTENING TCP    127.0.0.1:6999         MyComputer1:0          LISTENING TCP    127.0.0.1:6999         MyComputer1:49801      ESTABLISHED TCP    127.0.0.1:6999         MyComputer1:57172      TIME_WAIT
59360
Lately, we've become aware of a TCP connection issue that is mostly limited to mac and Linux users who browse our websites.  From the user perspective, it presents itself as a really long connection time to our websites (>11 seconds).  We've managed to track down the technical signature of this problem, but can't figure out why it is happening or how to fix it.  Basically, what is happening is that the client's machine is sending the SYN packet to establish the TCP connection and the web server receives it, but does not respond with the SYN/ACK packet.  After the client has sent many SYN packets, the server finally responds with a SYN/ACK packet and everything is fine for the remainder of the connection.  And, of course, the kicker to the problem: it is intermittent and does not happen all the time (though it does happen between 10-30% of the time)  We are using Fedora 12 Linux as the OS and Nginx as the web server.  Screenshot of wireshark analysis    Update:  Turning off window scaling on the client stopped the issue from happening.  Now I just need a server side resolution (we can't make all the clients do this) :)  Final Update:  The solution was to turn off both TCP window scaling and TCP timestamps on our servers that are accessible to the public.
59767
I am setting up a new server with 18.04 based on instructions written for 14.04. I have got as far as these steps:  /sbin/iptables -A FORWARD -p tcp --destination-port 80 -j ACCEPT /sbin/iptables -t nat -A PREROUTING -j REDIRECT -p tcp --destination-port 80 --to-ports 8080 /sbin/iptables-save # To save permanently (reset-persistent): sudo sh -c "iptables-save &gt; /etc/iptables.rules" # Modify in /etc/network/interfaces # Add this line:     pre-up iptables-restore &lt; /etc/iptables.rules     # As below:  # The loopback network interface auto lo iface lo inet loopback     pre-up iptables-restore &lt; /etc/iptables.rules  # The primary network interface auto eth0 eth1 iface eth0 inet static         address XXX.XXX.XX.XXX         netmask 255.255.255.0         gateway XXX.XXX.XX.1         dns-nameservers 8.8.4.4 8.8.8.8 XXX.XXX.0.3 iface eth1 inet static         address XX.XXX.67.47         netmask 255.255.0.0   But it turns out that 18.04 does things a different way, using something called netplan.   I have found questions and answers related to how to revert back to how things were done in 14.04, but I am wondering whether it is better to do the same thing the new way.   How can I do what is being done the old way using netplan?
104073
I have a Mikrotik RB2011 router, running RouterOS which connects to the internet via a static IP. In my lan I have two different servers, one that is on IP 192.168.89.11 and another on 192.168.89.12  My DNS (on cloudflare) resolves both myfirstserver.com and mysecondserver.com to my router's static IP.  Now, what I want to do is to somehow separate the traffic so all traffic for myfirstserver.com goes to 192.168.89.11 and traffic for mysecondserver.com goes to 192.168.89.12 (and both on port 80. I know I could just change ports but if these are servers publicly available, no user would set a different port than 80)  What I have tried so far, is to somehow mark the packets through mangle and then use that mark on NAT to do the proper dst-nat forward.  I try marking packets through either content or Layer 7 protocol regex (they work properly if the action is log. I can see them being logged correctly).  The thing is that after I mark them, it seems that NAT just ignores them and forwards the connection to the server that accepts the non-marked packets.  I think I have mixed up the order of filtering and the chains somehow.  Would someone be able to provide some pointers/assistance on how to accomplish this?  Thanks!  EDIT: My question is very specific, about marking packets in RouterOS on a Mikrotik router and checking the mark in NAT. it is not about whether i need a reverse proxy or whatever. Thanks  EDIT 2: @Cha0s asked my /ip firewall export so here it is:  /ip firewall layer7-protocol add name=haf1a regexp=haf1a  /ip firewall address-list add address=192.168.89.0/24 list=local add address=192.168.88.0/24 list=local add address=www.xxx.yyy.zzz list=local add address=192.168.87.0/24 list=local  /ip firewall filter add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=virus comment="Drop 80 DoS attack" src-address-list=spammer add action=add-src-to-address-list address-list=spammer address-list-timeout=1d chain=input connection-limit=10,32 dst-address-list=!local dst-port=53 protocol=udp add action=drop chain=input dst-port=53 protocol=udp src-address-list=!local add action=add-src-to-address-list address-list=spammer address-list-timeout=1d chain=input connection-limit=30,32 protocol=tcp /ip firewall mangle add action=change-mss chain=forward new-mss=1422 out-interface=all-ppp protocol=tcp tcp-flags=syn tcp-mss=1423-65535  /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway add action=masquerade chain=srcnat out-interface=pppoe-out1 add action=dst-nat chain=dstnat comment="No HAF mark" dst-address=www.xxx.yyy.zzz dst-port=80 packet-mark=!haf1 port="" protocol=tcp src-port="" to-addresses=192.168.89.41 to-ports=80 add action=dst-nat chain=dstnat comment="HAF mark" dst-address=www.xxx.yyy.zzz dst-port=80 packet-mark=haf1 port="" protocol=tcp src-port="" to-addresses=192.168.89.31 to-ports=80   where www.xxx.yyy.zzz is my external ip (static) and 192.168.89.31 and 192.168.89.41 my two servers inside my local network  My goal is to redirect any connections with haf1a in them (eg haf1a.lala.com) to the relevant server (192.168.89.31)
109826
The following IP address is for my network interface  $ nmap 192.168.0.142  Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:33 EST Nmap scan report for ocean (192.168.0.142) Host is up (0.00047s latency). Not shown: 996 closed ports PORT     STATE SERVICE 22/tcp   open  ssh 80/tcp   open  http 111/tcp  open  rpcbind 3306/tcp open  mysql  Nmap done: 1 IP address (1 host up) scanned in 0.97 seconds   Are those services shown below but not above exactly those that are closed to the outside but open within my local machine?   Are the services whose security that I should worry about exactly those listed above?  Thanks.  $ nmap localhost  Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:34 EST Nmap scan report for localhost (127.0.0.1) Host is up (0.00046s latency). Other addresses for localhost (not scanned): Not shown: 993 closed ports PORT     STATE SERVICE 22/tcp   open  ssh 80/tcp   open  http 111/tcp  open  rpcbind 631/tcp  open  ipp 3306/tcp open  mysql 5432/tcp open  postgresql 9050/tcp open  tor-socks  Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds
3933
I would like to block sites using iptables. How do I go about this, and how do I ensure that the iptables rules are saved?
59032
How can I protect my public images hosted on GCS from ddos attacks?  Does Google provide any protection, or should I pay for the bandwidth used by that attack?
100031
I have a little VPS I run apache and a Minecraft server on. I don't ever turn it off, but should I restart it for some reason, IPTables blocks most of my ports, including port 80. I've tried so many different suggestions on fixing this, but with no luck. Also, since the provider is OVH, the support is... lacking.  So, I've created a workaround, which I'm happy with. I created a simple shell script file to open certain ports I need opened on restart (80 and 25565 for now). The important ones such as 21 and 22 are not affected on restart.   The script looks like this:  iptables -I INPUT -p tcp --dport 80 -j ACCEPT iptables -I INPUT -p udp --dport 80 -j ACCEPT iptables -I INPUT -p tcp --dport 25565 -j ACCEPT iptables -I INPUT -p udp --dport 25565 -j ACCEPT /sbin/service iptables save   When I manually run it by typing /iptdef.sh, it runs fine, the ports become open and it's all good.  Of course, it's not practical having to remember to run it every time I restart the server, so I added a crontab. The problem is, it doesn't work/run. This is my crontab file:  */5 * * * * /backup2.sh */55 * * * * /backup3.sh @reboot /iptdef.sh * * * * *  /iptdef.sh   The first two lines work. They are just simple scripts that make a backup of a folder for me. The second two lines are what's not working.   Is there a chance that perhaps it's not possible to run iptables commands from a cron? It sounds silly, but I can't see any other reason for it not to work. The scripts have the correct permissions.
78468
I am running sendmail + dovecot in my Debian server. I have enabled the firewall rules to allow everything:   iptables -P INPUT ACCEPT   iptables -P OUTPUT ACCEPT   iptables -P FORWARD ACCEPT   iptables -F   iptables -X  However after a quick check at yougetsignal.com, my port 25 is still being blocked. But 143, 80 are okay.
117515
I was reading about DNS some days ago and learned how the requests are processed. If you surf to www.example.com, then a request will go to the Root Name Servers to see who owns that .com address, then another request will go to another, more local, DNS server to see who owns the example.com address and so on.  How is it technically possible that the 13 Root Name Servers can handle all requests done by earth's billions of Internet users simultaneosly without beeing ddos:ed?
75376
Fist let's block all Incoming, Outgoing signals  via iptables.     vi /etc/sysconfig/iptables   *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT -j DROP -A INPUT -j DROP -A FORWARD -j DROP COMMIT   start iptables:   service iptables start   My Ethernet Cable is plugged in. let's try something via terminal  ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.   that is all. just 1 line. after that it stalls. clearly iptables is blocking it successfully  now I am going to disconnect my Ethernet cable. my internet is disconnected.  let's try it again:  ping 8.8.8.8 connect: Network is unreachable   this time .. instantly.. it returns that message.  Clearly, weather it is "ping" or any other program.. it is determining if a network interface is up or not before it executes it's internet command.  of course soon as it executes.. it is not able to pass through iptable rules. but what seems evident is.. it does not first consult to the iptables..  it first checks to see if a network interface is connected or not.   I would like to figure out how I can manually let it know that network interface is connected.  in other words unless I tell it network interface is up.. it should simply behave the same way it behaves when network interface is not connected ( when the ethernet cable is not plugged in)  how can this be done ?
4759
Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. Suppose also that I want to grant that user access at some point; how do I enable it again? I am using Ubuntu Linux 10.04. It would be nice if anybody show me how to do it from the command line, as I often login to the machine using a local ssh login.