0

I have server with Debian 6 with a many games servers and sadly, I'm getting ddosed. I want make solid firewall, where my server will safe.

1 Answer 1

1

Use these iptables rules:

iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -j REJECT

The first rule accepts solicited inbound traffic by inspecting the state assigned by the connection tracking module. Packets are accepted when the state is:

ESTABLISHED (packets forming part of an existing connection that the firewall has previously decided to allow) or RELATED (packets that would start a new connection, but are known to be related to an existing connection).

ICMP here (2nd rule) is a special case because it is an integral part of the Internet Protocol which all hosts are supposed to support. It can be argued that blocking ICMP provides some minor security benefits, however in most situations this is likely to cause more inconvenience to legitimate users and administrators than it would to a potential attacker. For this reason, the method described here allows inbound ICMP traffic even if it is unsolicited.

The third rule accepts all traffic from the loopback interface. Any traffic received through the loopback interface must have originated on the local machine, therefore (by one means or another) it must have been solicited by the local machine.

2
  • I added rules to iptables, but servers, website still feels DDoS. :(
    – Maros
    Commented Apr 2, 2015 at 11:31
  • How do you know about the ddos and please show what's in your iptables. I suspect there you have more rules than just the three rules I mentioned.
    – wie5Ooma
    Commented Apr 2, 2015 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .