WTB WTB info + config + proxy vs DDOS and L2 OPENING

[chapunba]

Hello, well that I buy information on how to configure my l2off server for an opening, at the moment I am in Canada OVH SAS in my last opening I had to pay the attacker ddos to leave me alone, many will say that I have to hide the IP , put a proxy for the most powerful login, I don't know what, I pay for the service or the info. I can not upload the server in France Germany or Holland, I need Canda or USA.

 

discord: Krum#2504

skype: chapunba1

[InTheEndॐ]

I think @Trancecan help you.

[zemaitis]

On 5/12/2021 at 6:54 PM, InTheEndॐ said:

I think @Trancecan help you.

He tried helping me last time, but ddoser still managed to ddos me. 

[Trance]

3 hours ago, zemaitis said:

He tried helping me last time, but ddoser still managed to ddos me. 

I tried some basic stuff, I told you that needs time and packet capturing not an hour remote to your computer with no access either.

People need to understand how it works. It's not a "protection" you set and forget, or simply add one.

[zemaitis]

On 5/20/2021 at 2:32 AM, Trance said:

I tried some basic stuff, I told you that needs time and packet capturing not an hour remote to your computer with no access either.

People need to understand how it works. It's not a "protection" you set and forget, or simply add one.

I understand, I meant no harm with my comment. Are you still up for work tho?

[Trance]

On 5/23/2021 at 2:03 PM, zemaitis said:

I understand, I meant no harm with my comment. Are you still up for work tho?

L4. If you are hosting an L2 server, simply use the #19 rule to block all ipv4 and allow only the LS/GS ports open on TCP only. Only allow SSH connection on your home subnet like 10.11.0.0/16, or /32 on a single static ip or VPN. So you only have, let's say, those 2 ports open (3rd port SSH only for you) and you don't need to overwhelm your linux with rules (only TCP rules, since that's all you need). The #19 rule will block any other protocol.

 

You can start by solving a bug at ovh's firewall. One rule to drop connection if it's not SYN and the other one to block invalid packets. You can use the PREROUTING/mangle table/etc to save resources.

 

Overall, your rules can only get better in time and don't add a rule from the internet for the sake of adding it "just in case".

 

You could use SYNPROXY with some performance drops in return.

It needs to be carefully implemented not to drop active connections unexpectedly. This should help the most for all SYN attacks.

 

Tweak the kernel to support more connections and end connections faster.

 

Most important. Be ready to capture traffic like Wireshark does. So while you are under DDoS, try to run the linux command to capture traffic so you can analyze it and know for sure the attack type/trick used. This helps you the most to create the needed rules in iptables or whatever you are using on your linux. OR you can even send the capture to OVH to adjust the firewall on their side based on your needs.

 

You need someone to understand how TCP works/TCP flags, basically Layer 7 stuff to be able to read the capture for you if you are not familiar.

 

You can also buy multiple proxies, protected or not - even better if so, limit the incoming connections so it rather freezes than forwarding DDoS to your main server. AND block from the main server any connections except those new ones thru the proxy IPs. Allow established conns. They may get you 1 or 2 of them down, but not all and your players/main server won't even be affected. I did something similar a long time ago, I forgot most of the details.

 

You can also have a plan B on ovh's firewall. If you are under DDoS and wanna stop the lag in-game. / Connections to reach your server. Simply add a rule on top to allow established connections and block all ipv4 connections after. So you won't accept any new connections, but players in game won't experience any lag at all, other players won't be able to log in either during that time, until you revert it.

 

I recommend you all reading and learning about the following:

 

Linux kernel the network part

Iptables in general

Iptables procession (like the flowchart)

Network in general, most important Layer 7/TCP.

Packet capturing with Wireshark.

 

You can't be the owner of a server and not know how to handle this nowadays.

 

People, don't pm me about this, I'm not helping strangers, dosen't matter how much you pay for.

 

There are, of course, many ways and tricks you can use. I just shared above the most straight- forward ones.

 

from my Phone.

Edited June 1, 2021 by Trance