1

My server was hit by a flood from a single IP targeting a specific port (7777), which was captured using tcpdump, like so:

16:38:35.079994 IP 20.195.191.67.58074 > 12.34.56.78.7777: UDP, length 4

I attempted to block the source IP using two methods:

ip route add blackhole 20.195.191.67/32
iptables -A INPUT -s 20.195.191.67 -j DROP

However, tcpdump reported no change - the traffic from the IP kept coming. And my server was still feeling the effect of it (services barely responsive).

Am I missing something here? Why did my attempt to block the IP have no impact at all?

1
  • 2
    In order to process a packet, it must first arrive at the NIC. tcpdump reports what arrives at the NIC, so you will see traffic even if the kernel then DROPs it. Mar 16, 2021 at 14:24

3 Answers 3

1

Am I missing something here? Why did my attempt to block the IP have no impact at all?

Unless you have something running on port 7777 (Unreal tournament server?) then those packets were going to be dropped anyway. Telling iptables to specifically drop them only prevents Linux from looking for a program listening on that port. The packets still reach the server and are processed.

This is one big reason for having a dedicated firewall and then only opening up the ports on your server that you really need. Most come with some sort of flood detection / prevention for this type of scenario.

Unfortunately, if someone is able to flood your server by sending packets to a single port (which isn't used) then there's not much you can do to prevent this on the server itself.

2
  • So, having UFW installed and Enabled should do the work, right?
    – daniel_hck
    Mar 16, 2021 at 21:51
  • No dedicated firewall here means a separate physical device. That can be firewall configurations built into your internet router, an off-the-shelf firewall (hardware device) or a separate computer who's only job is to be a firewall. If this is a virtual machines in the cloud, cloud providers offer their own solutions to this such as AWS "Security Groups" Mar 17, 2021 at 9:13
1

As mentioned in the other answers, your server still needs to deal with the packets, iptables / firewalls or not. What you could try to do is block the IP on your router, or by funneling all your traffic through a "Cloudflare"-like service, which would handle the IP-blocking for you (and not make your hardware have to deal with the packet flood)

2
  • He literally tried to block it and is wondering why it did not work...
    – number9
    Mar 17, 2021 at 15:25
  • @number9 The thing is, it worked. Packets will always arrive on the network interface, regardles of whether you bother to block them or not.
    – Pourko
    Mar 17, 2021 at 21:36
0

Maybe think about installing fail2ban it does automatically block attacks from specific ips. I guess it would work out if your doing it now.

Regarding iptables did you: service iptables save

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.