Linux iptables simple request

[Michael10]

Can anybody tell me how I can open specific port to only these players which are/were connected to login server?

 

[Michael10]

bumpp

 

[Cykotitan]

TFS firewall by elf

 

[Michael10]

TFS firewall by elf

what do you mean by that?

 

[ugurdrahs]

TFS firewall by elf

ye, I ALSO dont know what u mean bu that..

 

[Cykotitan]

Nothing, just heard elf made some firewall by request

 

[Kippetjee]

this is only what u need

http://otland.net/f138/guide-linux-...p-127-0-1-1-ubuntu-server-104805/#post1050635

 

[Cykotitan]

no, he wants game port protection from tcp flood of liek

 

[Michael10]

no, he wants game port protection from tcp flood of liek

Yes indeed

 

[Cykotitan]

so say lipek and akues to stop ddos =/

 

[Michael10]

so say lipek and akues to stop ddos =/

I doesn't want to , i want basic protection from these kind of attacks.

 

[Michael10]

bumpp

 

[Michael10]

bump

 

[Michael10]

bumpp

 

[Michael10]

bump

 

[Michael10]

anybody?

 

[Cykotitan]

test rules
[cpp]-A INPUT -p tcp --tcp-flags ALL FIN,ACK --dport 7172 -m recent --name logout --set

-A INPUT -p tcp --tcp-flags ALL SYN --dport 7171 -m recent --name login --set

-A INPUT -p tcp -m tcp --syn --dport 7171 -m connlimit ! --connlimit-above 2 -j ACCEPT
-A INPUT -p tcp -m tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name logout -j ACCEPT
-A INPUT -p tcp -m tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --hitcount 5 --name login -j DROP
-A INPUT -p tcp -m tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name login -j ACCEPT[/cpp]
first rule MUST go above rule which looks something like this:
[cpp]-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT[/cpp]

or an improved version, it now checks packet size too

-N ch
-A ch -m recent --name login --set -j ACCEPT

-A INPUT -p tcp --dport 7171 --syn -m connlimit ! --connlimit-above 2 -j ACCEPT
-A INPUT -p tcp --tcp-flags PSH,ACK PSH,ACK --dport 7171 -m length --length [B]191:191[/B] -j ch
-A INPUT -p tcp --tcp-flags FIN,ACK FIN,ACK --dport 7172 -m recent --name logout --set

[B][COLOR="red"]-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT[/COLOR][/B]

-A INPUT -p tcp -m tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name logout -j ACCEPT
-A INPUT -p tcp -m tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --hitcount 5 --name login -j DROP
-A INPUT -p tcp -m tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name login -j ACCEPT