We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

DDOS Protection

rudyzainal
rudyzainal asked
on
Medium Priority
1,256 Views
Last Modified: 2010-04-11
I offer psybncs and shell access and all that, and my server recently was hit by DDOS. I have recently blocked any ICMP packets, and blocked any incoming UDP packets except port 53 (for DNS). I tried to ddos myself, and succeeded in preventing any PING ddos but when i UDP'ed myself my server was still hit. Where have I gone wrong? I also want to prevent TCP syn packet DDOSing, and i read somewhere that by filtering incoming TCP syn requests to drop any packets after a certain number of packet/sec is possible, but I am fairly new to this and I need some help in configuring my firewall. Can anyone give some examples on how to prevent DDOS attacks, or at least minimize them?
Comment
Watch Question

Rich RumbleSecurity Samurai
CERTIFIED EXPERT
Top Expert 2006

Commented:
What is your firewall? If it's a cisco pix, or router, they are able to "deflect" ddos to a certain degree. If other please specify. Also, what server are you running, windows IIS windows apache, linux apache... other?
Here are some things to understand, and possibly minimize dos attacks.: http://www.cisco.com/warp/public/707/newsflash.html
I also recommend DJBDNS (aka tinydns) over BIND,  2Billion times better than bind... http://cr.yp.to/djbdns.html
-rich

Commented:
Right, you should address firewall individually, RTFM, and use appropriate TA for better response:
https://www.experts-exchange.com/Security/Firewalls/

> but when i UDP'ed myself my server was still hit. Where have I gone wrong?

Check here:
http://www.iana.org/assignments/port-numbers

Sample:

xns-time         52/tcp     XNS Time Protocol
xns-time         52/udp    XNS Time Protocol
#                                   Susie Armstrong <Armstrong.wbst128@XEROX>
domain           53/tcp     Domain Name Server
domain           53/udp    Domain Name Server
#                                    Paul Mockapetris <PVM@ISI.EDU>
xns-ch             54/tcp     XNS Clearinghouse
xns-ch             54/udp    XNS Clearinghouse

TCP and UDP are different protocols, so you must default block all ports for both of them. Also, where you do not block, you may choose to condifer blocking only one way, probably inbound traffic.

Commented:
<ugh> condifer = consider

Author

Commented:
richrumble: I am using Linux IPCHAINS.

sunbow: I cant block any inbound TCP due to the nature and the purpose of the server. My current firewall has been configured to accept all inbound TCP packets, drop all ICMP, and drop all UDP packets EXCEPT UDP 53 for DNS. I am still losing my server and having to reboot after my test DDOS with a mere 30 DSL drone UDP attack
Security Samurai
CERTIFIED EXPERT
Top Expert 2006
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
rich,
its already set to drop, not reject. and my box is not behind any router. its situated on a datacenter. And yes i'd say about 30 DSL host to DDOS my own box for testing purpose, more or less.

But my original question was, is restricting incoming packets by filtering incoming TCP syn requests to drop any packets after a certain number of packet/sec possible, and if so will it help much, and the way to go about doing it. I have read up a bit on some burst rate limits and such, but the book I read wasnt meant for a novice like me, i guess.

I've upped the points for this question cause I was hit yet again and its getting quite irritating to have to go down to the datacenter to reboot my box twice in a fortnight.

Author

Commented:
thanks rich the links are useful. but so far it doesnt actually stop the ddos to my current box, but it does give certain insights as to what is needed and the lot.
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.