Survive from DDoS
Ivailo Tanusheff
i.tanusheff at procreditbank.bg
Wed May 28 14:22:38 UTC 2008
Hi,
What I wanted to say was to use pf, not ipf. You may use something like
this:
table <sshspammer> persist
block log quick from <sshspammer>
# sshspammer
# more than 6 ssh attempts in 15 seconds will be blocked ;)
pass in quick on $ext_if proto tcp to ($ext_if) port ssh keep state
(max-src-conn 10, max-src-conn-rate 6/15, overload <sshspammer> flush
global)
which I use for ssh flood protection or brute force attacks. You have to
change the syntax to use it for DNS.
Hope this will help you.
Regards,
Ivailo Tanusheff
Kalpin Erlangga Silaen <kalpin at muliahost.com>
Sent by: owner-freebsd-questions at freebsd.org
28.05.2008 11:34
To
Ivailo Tanusheff <i.tanusheff at procreditbank.bg>
cc
"freebsd-questions at freebsd.org" <freebsd-questions at freebsd.org>,
owner-freebsd-questions at freebsd.org
Subject
Re: Survive from DDoS
Dear Ivailo,
thank you for your response. I am using ipfw to limit all packets for
all open port in my server. But the packet size was 600 Mbps which could
not filtered by our ISP.
Ivailo Tanusheff wrote:
> Hi,
>
> you may use ipf to drop packets from the attacking host I suppose. Or
even
> limit the packets to the specified port.
>
> Regards,
>
> Ivailo Tanusheff
>
>
>
>
> Kalpin Erlangga Silaen <kalpin at muliahost.com>
> Sent by: owner-freebsd-questions at freebsd.org
> 28.05.2008 05:01
>
> To
> "freebsd-questions at freebsd.org" <freebsd-questions at freebsd.org>
> cc
>
> Subject
> Survive from DDoS
>
>
>
>
>
>
> Dear all,
>
> yesterday, our shell server was attack and server immeditiately reboot.
> I checked logs, it likes UDP flood with destination port 53. Is there
> any way how to survive from this kind attack? Also, is there any
> url/resources to improve our shell server?
>
> Thank you
>
>
> Kalpin Erlangga Silaen
>
>
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to
"freebsd-questions-unsubscribe at freebsd.org"
>
_______________________________________________
freebsd-questions at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to
"freebsd-questions-unsubscribe at freebsd.org"
More information about the freebsd-questions
mailing list