Discussion :

[harima]

Salut. Un pote se fait DDoS sur son dédié kimsufi OVH. J'aimerais l'aider à stopper l'attaquer.

monitoring iptraf :




un peu de log iptraf :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Sat Oct 25 14:40:04 2008; ******** IP traffic monitor started ********
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 212.219.220.226:2873 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 212.219.220.226:2873 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 212.214.225.219:1026 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 212.214.225.219:1026 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 215.227.213.229:1756 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 215.227.213.229:1756 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; ICMP; eth0; 56 bytes; source MAC address 00d0d3369e40; from 205.171.28.74 to 91.121.99.72; time excd
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 220.224.227.211:2873 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 220.224.227.211:2873 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 221.222.223.213:2001 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 221.222.223.213:2001 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 217.221.215.216:1026 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 217.221.215.216:1026 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 1500 bytes; from 91.121.99.72:22 to 82.226.75.248:3153 (source MAC addr 001cc002a0f6); first packet
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 218.226.214.216:9000 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 218.226.214.216:9000 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 225.224.227.227:9000 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 228.212.211.211:1756 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 227.211.223.216:1026 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 66.130.173.132:33666 to 91.121.99.72:80 (source MAC addr 00d0d3369e40); first packet
Sat Oct 25 14:40:04 2008; TCP; eth0; 1440 bytes; from 91.121.99.72:80 to 66.130.173.132:33666 (source MAC addr 001cc002a0f6); first packet
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 220.223.215.225:2873 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 220.223.215.225:2873 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 219.221.225.229:4055 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 219.221.225.229:4055 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 213.223.225.226:1234 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 213.223.225.226:1234 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 217.222.219.226:2001 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 217.222.219.226:2001 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 216.224.220.222:2873 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)
Sat Oct 25 14:40:04 2008; TCP; eth0; 40 bytes; from 91.121.99.72:5121 to 216.224.220.222:2873 (source MAC addr 001cc002a0f6); Connection reset; 1 packets, 40 bytes, avg flow rate 0.00 kbits/s; opposite direction 1 packets, 46 bytes; avg flow rate 0.00 kbits/s
Sat Oct 25 14:40:04 2008; TCP; eth0; 46 bytes; from 221.220.227.217:1739 to 91.121.99.72:5121 (source MAC addr 00d0d3369e40); first packet (SYN)

mon iptables :

#!/bin/bash

# Iptable

# Vider les tables actuelles
iptables -t filter -F
iptables -t filter -X
echo - Vidage : [OK]

# Autoriser SSH
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
echo - Autoriser SSH : [OK]

# Ne pas casser les connexions etablies
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
echo - Ne pas casser les connexions établies : [OK]

# Interdire toute connexion entrante
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
echo - Interdire toute connexion entrante : [OK]

# Interdire toute connexion sortante
iptables -t filter -P OUTPUT DROP
echo - Interdire toute connexion sortante : [OK]

# Autoriser les requetes DNS, FTP, HTTP, NTP (pour les mises a jour)
iptables -t filter -A OUTPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT
echo - Autoriser les requetes DNS, FTP, HTTP, NTP : [OK]

# Autoriser loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT
echo - Autoriser loopback : [OK]

# Autoriser ping chez OVH
iptables -A INPUT -i eth0 -p icmp --source proxy.ovh.net -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --source proxy.p19.ovh.net -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --source proxy.rbx.ovh.net -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --source ping.ovh.net -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --source 91.121.99.250 -j ACCEPT
echo - Autoriser ping : [OK]

# Syn Cookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo - Syncookies : [OK]

# Syn-Flood
iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
echo - Limiter le Syn-Flood : [OK]

# FDP
iptables -I INPUT -m iprange --src-range 210.0.0.0-230.255.255.255 -j DROP
echo - Anti fdp : [OK]

# Spoofing
iptables -N SPOOFED
iptables -A SPOOFED -s 127.0.0.0/8 -j DROP
iptables -A SPOOFED -s 169.254.0.0/12 -j DROP
iptables -A SPOOFED -s 172.16.0.0/12 -j DROP
iptables -A SPOOFED -s 192.168.0.0/16 -j DROP
iptables -A SPOOFED -s 10.0.0.0/8 -j DROP
echo - Bloquer le Spoofing : [OK]

# HTTP
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 8443 -j ACCEPT
echo - Autoriser serveur Apache : [OK]

# TEAMSPEAK
iptables -t filter -A INPUT -p tcp --dport 14534 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 51234 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 8767 -j ACCEPT
echo - Autoriser TeamSpeak : [OK]

# emulateur
iptables -t filter -A INPUT -p tcp --dport 6900 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 6121 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 5121 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 3306 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 6900 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 6121 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 5121 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 3306 -j ACCEPT
echo - Autoriser eAthena : [OK]

# FTP
iptables -t filter -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
echo - Autoriser serveur FTP : [OK]

# Mail
iptables -t filter -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 110 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 143 -j ACCEPT
echo - Autoriser serveur Mail : [OK]

En gras la plage ip du DDoS que j'ai essayer de contrer, mais en vain... des idées?

[_solo]

plop,

Linux a ca de plus que windows : c'est qu'a chaque changement de config il n'a pas un besoin systematique de rebooter il faut donc en abuser les regles du FW doivent etre minimal pour les connexions entrante et sortante , si t'as besoin de certains protocol que dans certains cas faire en sorte de les activer uniquement et uniquement a ce moment la.

De plus certains ports doser ne semble pas appartenir aux regles , drop aussi les ports sinon certains ISPs possedent des sinkhole/blakhole et les mettent a disposition (encore???) faut les utiliser et au lieux de dropper tous les paquets.

-Faire du matching de pattern , tous les paquets que recoit la box doivent avoir des particularites , apres avoir etudier les droppers/blakholer.

-Faire un tunning plus poussee de la pile IP parce que ton attack ressemble a "un simple" synflood , le temps de connexion, d'inactivite, nombre de connexion etc...

Mais quoi qu'il arrive c'est pas avec un simple box que tu arrete un (d)dos (donc pas de recette magique), il faut un veritable mini reseaux derriere faire de repartition de charge etc...