nixCraft Linux Forum

nixCraft

Linux Tech Support Forum

DDOS attack on VPS!!!!

This is a discussion on DDOS attack on VPS!!!! within the Linux software forums, part of the Linux Getting Started category; we are facing DDOS attack on VPS. And datacenter can not help in it. It's on port80. Mod_evasive is installed ...


Go Back   nixCraft Linux Forum > Linux Getting Started > Linux software

DDOS attack on VPS!!!! DDOS attack on VPS!!!!

Register FAQ Members List Calendar Forgotten your password? Mark Forums Read

Reply
Page 1 of 2 1 2 >

 

LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 11-23-2006, 01:48 PM
Junior Member
User
  
Join Date: Nov 2006
Posts: 14
Rep Power: 0
deltamails
Default DDOS attack on VPS!!!!
we are facing DDOS attack on VPS. And datacenter can not help in it. It's on port80.
Mod_evasive is installed but its not enough.
i tried script
http://bash.cyberciti.biz/security/v...cript.bash.php

When I start this script it blocks all the ports and services. I have made all the changes for IP in script but it's not working.
How can I make this script work on VPS and block IP's through it.

Operating system is CentOS 4.3
Please suggest.
Thanks.
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 11-23-2006, 03:09 PM
rockdalinux's Avatar
Contributors
User
  
Join Date: May 2005
Location: Bangalore
My distro: RHEL, HP-UX, Solaris, FreeBSD, Ubuntu
Posts: 581
Rep Power: 7
rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough
Default
Hello,

Sorry to hear about your problem. If you just need to block IPs try something as follows which is modified from original script.

First create file /root/allbadips.txt and append all bad ips to this file.

Now create script as follows called /root/fw.start. Setup it as follows:
Setup all VPS IPS separated by a black space, if you have 3 ips such as 202.51.1.1, 202.51.1.2 and 202.51.1.3
Code:
myIP="202.51.1.1 202.51.1.2  202.51.1.3"
Setup VPS main IP here which is bind to Apache port 80, if it is 202.51.1.3
Code:
ip="202.51.1.3"
Setup your DNS name server IPS, if it is 55.1.23.5 and 55.1.23.6
# ISP name server 1 and 2
NSIP="55.1.23.5 55.1.23.6"

Complete modified script:
Code:
#!/bin/bash
# BAD IPS FILE all ip in this file are drooped
BADIPS="$(cat /root/allbadips.txt|grep -v -E '^#')"

# setup ALL your IPS here 
myIP="xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx"

# Setup VPS main IP here
ip="xxx.xxx.xxx.xxx"

# ISP name server 1 and 2
NSIP="ns1_IP  ns2_IP" 

# stop RedHAT linux iptables
service  iptables stop

# Setting default filter policy DROP ALL :D
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# allow unlinited traffic on both lo and venet0
iptables -A INPUT  -i venet0 -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o venet0 -d 127.0.0.1 -j ACCEPT

iptables -A INPUT  -i lo -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT
#
# Block all those BAD IPs 
#
for ipb in $BADIPS
do
    iptables -A INPUT -s $ipb -j DROP
    iptables -A OUTPUT -d $ipb -j DROP
done

# Stop  flood 
iptables -N flood
iptables -A INPUT -p tcp --syn -j flood
iptables -A flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A flood -j DROP

# Spoofing and bad addresses
# Bad incoming source ip address i.e server IP drop all here
for myip in $myIPS
do
    iptables -A INPUT -s $myip -j DROP
done

# Drop all incoming fragments
iptables -A INPUT -f -j DROP

# Drop all incoming malformed XMAS packets
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Drop all incoming malformed NULL packets
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Bad incoming source ip address 0.0.0.0/8
iptables -A INPUT -s 0.0.0.0/8 -j DROP

# Bad incoming source ip address 127.0.0.0/8
iptables -A INPUT -s 127.0.0.0/8 -j DROP

# Bad incoming source ip address 10.0.0.0/8
iptables -A INPUT -s 10.0.0.0/8 -j DROP

# Bad incoming source ip address 172.16.0.0/12
iptables -A INPUT -s 172.16.0.0/12 -j DROP

# Bad incoming source ip address 192.168.0.0/16
iptables -A INPUT -s 192.168.0.0/16 -j DROP

# Bad incoming source ip address 224.0.0.0/3
iptables -A INPUT -s 224.0.0.0/3 -j DROP

#Open Port 80 
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $ip --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -s $ip --sport 80 -d 0/0 --dport 1024:65535 -j ACCEPT

#Open Port 443
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $ip --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -s $ip --sport 443 -d 0/0 --dport 1024:65535 -j ACCEPT

#Open Port 25
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $ip --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp -s $ip --sport 25 -d 0/0 --dport 1024:65535 -j ACCEPT

#Open port 22 for all
iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 -d $ip --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -s $ip --sport 22 -d 0/0 --dport 513:65535 -j ACCEPT

# Outgoing DNS
# udp first
#ip="your_main_IP"
for mip in $NSIP
do
  iptables -A OUTPUT -p udp -s $ip --sport 1024:65535 -d $mip --dport 53 -j ACCEPT
  iptables -A INPUT -p udp -s $mip --sport 53 -d $ip --dport 1024:65535 -j ACCEPT
  # tcp next
  iptables -A OUTPUT -p tcp -s $ip --sport 1024:65535 -d $mip --dport 53 -j ACCEPT
  iptables -A INPUT -p tcp -s $mip --sport 53 -d $ip --dport 1024:65535 -j ACCEPT
done

#outgoing SMTP
#ip="your_main_IP"
iptables -A OUTPUT -p tcp -s $ip --sport 1024:65535 -d 0/0 --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 25 -d $ip --dport 1024:65535 -j ACCEPT

#outgoin SSH
#ip="your_main_IP"
iptables -A OUTPUT -p tcp -s $ip  --sport 513:65535 -d 0/0 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 22 -d $ip --dport 513:65535 -j ACCEPT

# Okay Drop everything from here :D 
iptables -A INPUT -s 0/0 -j DROP
iptables -A OUTPUT -d 0/0 -j DROP
Save and run script:
Code:
chmod +x /root/fw.start
/root/fw.start
If they are using too many dynamic ips it may become hard for VPS to block and handle all IPS. But try out above and let us know the details.
__________________
Rocky Jr.
You may have my body & soul, but you will never touch my pride!

If you have knowledge, let others light their candles at it.

Certified to work on HP-UX / Sun Solaris / RedHat
Reply With Quote
  #3 (permalink)  
Old 11-23-2006, 03:25 PM
monk's Avatar
Senior Member
User
  
Join Date: Jan 2005
Location: Tibet
My distro: Debian GNU/Linux
Posts: 482
Rep Power: 5
monk will become famous soon enough monk will become famous soon enough
Default
Theres not much you can do except block IPS. But VPS has many restrictions such as limited availability of iptables rules and memory limites. Try out above rules.

Your best option is to ask your service provider to migrate DDoS attack.
Reply With Quote
  #4 (permalink)  
Old 11-23-2006, 03:30 PM
tom tom is offline
Contributors
User
  
Join Date: Jun 2005
Location: London, UK
Posts: 213
Rep Power: 4
tom is on a distinguished road
Default
What kind of attack? Is this syn floods with dynamic IPs? It is very hard to track where an attack comes from because of bots controlled by attackers and they change IPs every 30 minute or an hour.

As suggested by monk it is better to use DDoS filtering service.

Good luck.
Reply With Quote
  #5 (permalink)  
Old 11-23-2006, 04:25 PM
Junior Member
User
  
Join Date: Nov 2006
Posts: 14
Rep Power: 0
deltamails
Default
Hello,
Thanks everyone for reply.
I made script and ran it

output is

Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
iptables: No chain/target/match by that name
Reply With Quote
  #6 (permalink)  
Old 11-23-2006, 04:31 PM
rockdalinux's Avatar
Contributors
User
  
Join Date: May 2005
Location: Bangalore
My distro: RHEL, HP-UX, Solaris, FreeBSD, Ubuntu
Posts: 581
Rep Power: 7
rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough
Default
It appears that few modules are not loaded by your service provider. What is the output of following command?
Code:
iptables -L -n
Also run following command and find out when you see error iptables: No chain/target/match by that name - so that we can add or remove rules to VPS
Code:
sh -x fw.start
__________________
Rocky Jr.
You may have my body & soul, but you will never touch my pride!

If you have knowledge, let others light their candles at it.

Certified to work on HP-UX / Sun Solaris / RedHat
Reply With Quote
  #7 (permalink)  
Old 11-23-2006, 04:40 PM
Junior Member
User
  
Join Date: Nov 2006
Posts: 14
Rep Power: 0
deltamails
Default
# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination


------------------------------++
g[root@jupiter ~]# sh -x fw.start
++ cat /root/allbadips.txt
++ grep -v -E '^#'
+ BADIPS='81.170.239.78
69.115.181.157
85.147.68.248
84.145.173.106
69.115.181.157
85.147.68.248
84.145.173.106
69.231.44.193
80.100.68.193
213.173.255.181
84.168.52.36
84.168.19.66
84.168.40.44
84.168.31.17
193.217.29.213'
+ myIP=66.235.251.194
+ ip=66.235.251.194
+ NSIP='66.235.251.138 66.235.251.141'
+ service iptables stop
+ iptables -P INPUT DROP
+ iptables -P OUTPUT DROP
+ iptables -P FORWARD DROP
+ iptables -A INPUT -i venet0 -s 127.0.0.1 -j ACCEPT
+ iptables -A OUTPUT -o venet0 -d 127.0.0.1 -j ACCEPT
+ iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
+ iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 81.170.239.78 -j DROP
+ iptables -A OUTPUT -d 81.170.239.78 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 69.115.181.157 -j DROP
+ iptables -A OUTPUT -d 69.115.181.157 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 85.147.68.248 -j DROP
+ iptables -A OUTPUT -d 85.147.68.248 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 84.145.173.106 -j DROP
+ iptables -A OUTPUT -d 84.145.173.106 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 69.115.181.157 -j DROP
+ iptables -A OUTPUT -d 69.115.181.157 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 85.147.68.248 -j DROP
+ iptables -A OUTPUT -d 85.147.68.248 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 84.145.173.106 -j DROP
+ iptables -A OUTPUT -d 84.145.173.106 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 69.231.44.193 -j DROP
+ iptables -A OUTPUT -d 69.231.44.193 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 80.100.68.193 -j DROP
+ iptables -A OUTPUT -d 80.100.68.193 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 213.173.255.181 -j DROP
+ iptables -A OUTPUT -d 213.173.255.181 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 84.168.52.36 -j DROP
+ iptables -A OUTPUT -d 84.168.52.36 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 84.168.19.66 -j DROP
+ iptables -A OUTPUT -d 84.168.19.66 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 84.168.40.44 -j DROP
+ iptables -A OUTPUT -d 84.168.40.44 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 84.168.31.17 -j DROP
+ iptables -A OUTPUT -d 84.168.31.17 -j DROP
+ for ipb in '$BADIPS'
+ iptables -A INPUT -s 193.217.29.213 -j DROP
+ iptables -A OUTPUT -d 193.217.29.213 -j DROP
+ iptables -N flood
+ iptables -A INPUT -p tcp --syn -j flood
+ iptables -A flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables: No chain/target/match by that name
+ iptables -A flood -j DROP
+ iptables -A INPUT -f -j DROP
+ iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
+ iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
+ iptables -A INPUT -s 0.0.0.0/8 -j DROP
+ iptables -A INPUT -s 127.0.0.0/8 -j DROP
+ iptables -A INPUT -s 10.0.0.0/8 -j DROP
+ iptables -A INPUT -s 172.16.0.0/12 -j DROP
+ iptables -A INPUT -s 192.168.0.0/16 -j DROP
+ iptables -A INPUT -s 224.0.0.0/3 -j DROP
+ iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 66.235.251.194 --dport 80 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 80 -d 0/0 --dport 1024:65535 -j ACCEPT
+ iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 66.235.251.194 --dport 443 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 443 -d 0/0 --dport 1024:65535 -j ACCEPT
+ iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 66.235.251.194 --dport 25 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 25 -d 0/0 --dport 1024:65535 -j ACCEPT
+ iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 -d 66.235.251.194 --dport 22 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 22 -d 0/0 --dport 513:65535 -j ACCEPT
+ for mip in '$NSIP'
+ iptables -A OUTPUT -p udp -s 66.235.251.194 --sport 1024:65535 -d 66.235.251.138 --dport 53 -j ACCEPT
+ iptables -A INPUT -p udp -s 66.235.251.138 --sport 53 -d 66.235.251.194 --dport 1024:65535 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 1024:65535 -d 66.235.251.138 --dport 53 -j ACCEPT
+ iptables -A INPUT -p tcp -s 66.235.251.138 --sport 53 -d 66.235.251.194 --dport 1024:65535 -j ACCEPT
+ for mip in '$NSIP'
+ iptables -A OUTPUT -p udp -s 66.235.251.194 --sport 1024:65535 -d 66.235.251.141 --dport 53 -j ACCEPT
+ iptables -A INPUT -p udp -s 66.235.251.141 --sport 53 -d 66.235.251.194 --dport 1024:65535 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 1024:65535 -d 66.235.251.141 --dport 53 -j ACCEPT
+ iptables -A INPUT -p tcp -s 66.235.251.141 --sport 53 -d 66.235.251.194 --dport 1024:65535 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 1024:65535 -d 0/0 --dport 25 -j ACCEPT
+ iptables -A INPUT -p tcp -s 0/0 --sport 25 -d 66.235.251.194 --dport 1024:65535 -j ACCEPT
+ iptables -A OUTPUT -p tcp -s 66.235.251.194 --sport 513:65535 -d 0/0 --dport 22 -j ACCEPT
+ iptables -A INPUT -p tcp -s 0/0 --sport 22 -d 66.235.251.194 --dport 513:65535 -j ACCEPT
+ iptables -A INPUT -s 0/0 -j DROP
+ iptables -A OUTPUT -d 0/0 -j DROP
------------------
Reply With Quote
  #8 (permalink)  
Old 11-23-2006, 04:47 PM
rockdalinux's Avatar
Contributors
User
  
Join Date: May 2005
Location: Bangalore
My distro: RHEL, HP-UX, Solaris, FreeBSD, Ubuntu
Posts: 581
Rep Power: 7
rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough rockdalinux is a jewel in the rough
Default
It appears that vps is not loaded with iptables syn module or support is not included. Just remove following 4 lines from script and reload again

Code:
# Stop  flood 
iptables -N flood 
iptables -A INPUT -p tcp --syn -j flood 
iptables -A flood -m limit --limit 1/s --limit-burst 3 -j RETURN 
iptables -A flood -j DROP
Just start fw again
Code:
/root/fw.start
Verify that iptables loaded
Code:
iptables -L -n
__________________
Rocky Jr.
You may have my body & soul, but you will never touch my pride!

If you have knowledge, let others light their candles at it.

Certified to work on HP-UX / Sun Solaris / RedHat
Reply With Quote
  #9 (permalink)  
Old 11-23-2006, 06:30 PM
Junior Member
User
  
Join Date: Nov 2006
Posts: 14
Rep Power: 0
deltamails
Default
[root@jupiter ~]# ./fw.start
Flushing firewall rules: [ OK ]
Setting chains to policy ACCEPT: filter [ OK ]
[root@jupiter ~]# service httpd start

-------------------------------------------------
[root@jupiter ~]#
[root@jupiter ~]# iptables -L -n
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 127.0.0.1 0.0.0.0/0
ACCEPT all -- 127.0.0.1 0.0.0.0/0
DROP all -- 81.170.239.78 0.0.0.0/0
DROP all -- 69.115.181.157 0.0.0.0/0
DROP all -- 85.147.68.248 0.0.0.0/0
DROP all -- 84.145.173.106 0.0.0.0/0
DROP all -- 69.115.181.157 0.0.0.0/0
DROP all -- 85.147.68.248 0.0.0.0/0
DROP all -- 84.145.173.106 0.0.0.0/0
DROP all -- 69.231.44.193 0.0.0.0/0
DROP all -- 80.100.68.193 0.0.0.0/0
DROP all -- 213.173.255.181 0.0.0.0/0
DROP all -- 84.168.52.36 0.0.0.0/0
DROP all -- 84.168.19.66 0.0.0.0/0
DROP all -- 84.168.40.44 0.0.0.0/0
DROP all -- 84.168.31.17 0.0.0.0/0
DROP all -- 193.217.29.213 0.0.0.0/0
DROP all -f 0.0.0.0/0 0.0.0.0/0
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
DROP all -- 0.0.0.0/8 0.0.0.0/0
DROP all -- 127.0.0.0/8 0.0.0.0/0
DROP all -- 10.0.0.0/8 0.0.0.0/0
DROP all -- 172.16.0.0/12 0.0.0.0/0
DROP all -- 192.168.0.0/16 0.0.0.0/0
DROP all -- 224.0.0.0/3 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 66.235.251.194 tcp spts:1024:65535 dpt:80
ACCEPT tcp -- 0.0.0.0/0 66.235.251.194 tcp spts:1024:65535 dpt:443
ACCEPT tcp -- 0.0.0.0/0 66.235.251.194 tcp spts:1024:65535 dpt:25
ACCEPT tcp -- 0.0.0.0/0 66.235.251.194 tcp spts:513:65535 dpt:22
ACCEPT udp -- 66.235.251.138 66.235.251.194 udp spt:53 dpts:1024:65535
ACCEPT tcp -- 66.235.251.138 66.235.251.194 tcp spt:53 dpts:1024:65535
ACCEPT udp -- 66.235.251.141 66.235.251.194 udp spt:53 dpts:1024:65535
ACCEPT tcp -- 66.235.251.141 66.235.251.194 tcp spt:53 dpts:1024:65535
ACCEPT tcp -- 0.0.0.0/0 66.235.251.194 tcp spt:25 dpts:1024:65535
ACCEPT tcp -- 0.0.0.0/0 66.235.251.194 tcp spt:22 dpts:513:65535
DROP all -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 127.0.0.1
ACCEPT all -- 0.0.0.0/0 127.0.0.1
DROP all -- 0.0.0.0/0 81.170.239.78
DROP all -- 0.0.0.0/0 69.115.181.157
DROP all -- 0.0.0.0/0 85.147.68.248
DROP all -- 0.0.0.0/0 84.145.173.106
DROP all -- 0.0.0.0/0 69.115.181.157
DROP all -- 0.0.0.0/0 85.147.68.248
DROP all -- 0.0.0.0/0 84.145.173.106
DROP all -- 0.0.0.0/0 69.231.44.193
DROP all -- 0.0.0.0/0 80.100.68.193
DROP all -- 0.0.0.0/0 213.173.255.181
DROP all -- 0.0.0.0/0 84.168.52.36
DROP all -- 0.0.0.0/0 84.168.19.66
DROP all -- 0.0.0.0/0 84.168.40.44
DROP all -- 0.0.0.0/0 84.168.31.17
DROP all -- 0.0.0.0/0 193.217.29.213
ACCEPT tcp -- 66.235.251.194 0.0.0.0/0 tcp spt:80 dpts:1024:65535
ACCEPT tcp -- 66.235.251.194 0.0.0.0/0 tcp spt:443 dpts:1024:65535
ACCEPT tcp -- 66.235.251.194 0.0.0.0/0 tcp spt:25 dpts:1024:65535
ACCEPT tcp -- 66.235.251.194 0.0.0.0/0 tcp spt:22 dpts:513:65535
ACCEPT udp -- 66.235.251.194 66.235.251.138 udp spts:1024:65535 dpt:53
ACCEPT tcp -- 66.235.251.194 66.235.251.138 tcp spts:1024:65535 dpt:53
ACCEPT udp -- 66.235.251.194 66.235.251.141 udp spts:1024:65535 dpt:53
ACCEPT tcp -- 66.235.251.194 66.235.251.141 tcp spts:1024:65535 dpt:53
ACCEPT tcp -- 66.235.251.194 0.0.0.0/0 tcp spts:1024:65535 dpt:25
ACCEPT tcp -- 66.235.251.194 0.0.0.0/0 tcp spts:513:65535 dpt:22
DROP all -- 0.0.0.0/0 0.0.0.0/0
[root@jupiter ~]#
Reply With Quote
  #10 (permalink)  
Old 11-23-2006, 06:55 PM
Junior Member
User
  
Join Date: Nov 2006
Posts: 14
Rep Power: 0
deltamails
Default
Damnnnn so many connections to port 80
The moment i start apache it get flooded with hundreds of connections
Please suggest.
Reply With Quote
Reply
Page 1 of 2 1 2 >

Bookmarks

« rhce-config-4.0-0.55.noarch.rpm | problem in mysql client »

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

 
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Similar Threads

Thread Thread Starter Forum Replies Last Post
DOS and DDOS Attacked surmandal Networking, Firewalls and Security 2 04-01-2007 11:02 AM


All times are GMT +5.5. The time now is 10:24 PM.

Contact Us - Linux answers from nixCraft - Archive - Top

Powered by vBulletin® Version 3.7.4 - Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36