Linux Website getting nuked

[picachu]

Hi guys!
i'm using ubuntu 10.04
my website is getting down! one guy said "i'm going to shutdown your website" and it gets offline, but the server still online.
can someone give me some iptable to protect my apache against that guy, or something i can do ?
thanks

 

[DestinationSer]

Lol, i dunno if this works on websites but u can try
Go to start
Search CMD, write in netstat
The ip popping up several time very often when your web gets "nuked", that ip you're gonna block. Right click and block it.

 

[picachu]

Lol, i dunno if this works on websites but u can try
Go to start
Search CMD, write in netstat
The ip popping up several time very often when your web gets "nuked", that ip you're gonna block. Right click and block it.

I'm using Linux.

 

[Ninja]

Search after IP tables on google?

 

[picachu]

Search after IP tables on google?

I tried some. Didnt worked.

 

[DestinationSer]

Uhm,
You dont get any laggs when this "Nuking" happends?

 

[picachu]

Uhm,
You dont get any laggs when this "Nuking" happends?

Nope. Only the website start to lagged and gets offline.

 

[DestinationSer]

Go search on google or otland for DDoS protection or something. I guess that will help you

 

[Herpicus]

/etc/iptables.rules

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [39:5923]


-A INPUT -i lo -j ACCEPT


-N ch
-A ch -m recent --name login --set -j ACCEPT


-A INPUT -m recent --name ban --rcheck --seconds 1200 -j DROP
-A INPUT -p udp ! -s 192.168.1.0/24 -j DROP -m recent --set --name ban
-A INPUT ! -p tcp -j DROP


-A INPUT -p tcp --syn ! -s 192.168.1.0/24 -m connlimit --connlimit-above 25 -j DROP -m recent --set --name ban


-A INPUT -p tcp --tcp-flags PSH,ACK PSH,ACK --dport 7171 -m length --length 191:191 -j ch
-A INPUT -p tcp --tcp-flags FIN,ACK FIN,ACK --dport 7172 -m recent --name logout --set


-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT


-A INPUT -p tcp --syn --dport 80 -j ACCEPT
-A INPUT -p tcp --syn --dport 7171 -m connlimit ! --connlimit-above 2 -j ACCEPT
-A INPUT -p tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name logout -j ACCEPT
-A INPUT -p tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --hitcount 5 --name login -j DROP
-A INPUT -p tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name login -j ACCEPT


-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 3306 -j ACCEPT


COMMIT

Will block connection from an IP if they send 25 or more connections in a certain amount of time.

 

[picachu]

/etc/iptables.rules

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [39:5923]


-A INPUT -i lo -j ACCEPT


-N ch
-A ch -m recent --name login --set -j ACCEPT


-A INPUT -m recent --name ban --rcheck --seconds 1200 -j DROP
-A INPUT -p udp ! -s 192.168.1.0/24 -j DROP -m recent --set --name ban
-A INPUT ! -p tcp -j DROP


-A INPUT -p tcp --syn ! -s 192.168.1.0/24 -m connlimit --connlimit-above 25 -j DROP -m recent --set --name ban


-A INPUT -p tcp --tcp-flags PSH,ACK PSH,ACK --dport 7171 -m length --length 191:191 -j ch
-A INPUT -p tcp --tcp-flags FIN,ACK FIN,ACK --dport 7172 -m recent --name logout --set


-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT


-A INPUT -p tcp --syn --dport 80 -j ACCEPT
-A INPUT -p tcp --syn --dport 7171 -m connlimit ! --connlimit-above 2 -j ACCEPT
-A INPUT -p tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name logout -j ACCEPT
-A INPUT -p tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --hitcount 5 --name login -j DROP
-A INPUT -p tcp --syn --dport 7172 -m recent --rcheck --seconds 30 --name login -j ACCEPT


-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 3306 -j ACCEPT


COMMIT

Will block connection from an IP if they send 25 or more connections in a certain amount of time.

Using that i can connect to the server, but not to the website! :S

 

[Herpicus]

Using that i can connect to the server, but not to the website! :S

Then you did something wrong :/
You may need to edit some of the addresses

 

[picachu]

Then you did something wrong :/
You may need to edit some of the addresses

What i need to edit?
Sry, i dnot know anything about iptables :s

 

[picachu]

bump


Those lines are bloking the access to my website:

iptables -A INPUT -m recent --name ban --rcheck --seconds 1200 -j DROP
iptables -A INPUT -p udp ! -s 192.168.1.0/24 -j DROP -m recent --set --name ban
iptables -A INPUT ! -p tcp -j DROP

how to fix then to make it work properly?
ty

 

[Cykotitan]

-A INPUT -p udp ! -s 192.168.1.0/24 -j DROP -m recent --set --name ban

Seems you forgot he isn't using a router for the DNS service