0

Following IPTables rules exist on my system as some preventive measures against DDoS attacks

-A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" 
-A INPUT -s 255.0.0.0/8 -j DROP
-A INPUT -s 0.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
-A INPUT -s 0.0.0.0/8 -j DROP

Is it restricting private IP Address Group with the assumption that packets originating from private IP Address range from Internet are actually spoofed IP Address. Also, How to calculate the corresponding IP Address range from the above subnets ?

| improve this question | | | | |
  • 1
    Note that iptables rules only causes the packets to be dropped/rejected AFTER they have already been received by your router/network-interface. They still consume bandwidth on your network interface. This can be enough to prevent your network services (e.g. apache) from being overloaded with too much bogus work, but if you are under serious DDoS attack, you need to talk to your service provider to have the packets blocked upstream from you. – cas May 10 '16 at 8:55
1

The -A INPUT -s adds a rule for any packets with the source subnets specified on the line.

Therefore, in your example, you are logging and dropping all packets that have a source IP address that starts with 255 and all that start with 0, such as 255.1.2.3.4 or 0.56.78.90

The idea here is that there should will never be packets that start with those addresses and therefore if they do appear, they must be spoofed.

There are actually many more invalid or reserved IP addresses that the ones you've listed which could be added to that list.

There are plenty of resources on subnets and plenty of online subnet calculators to help you out. In your case, the /8 states that the first 8 bits of the IP address specify the network and all the others (the remaining 24) specify a host within that subnet. In both examples, the first octet (8 bits) is the network and the other three octets can be any value. Your 255.0.0.0/8 therefore can be from 255.0.0.0 to 255.255.255.255 and your 0.0.0.0/8 can be from 0.0.0.0 to 0.255.255.255.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.