Step 9: Protecting Your Server Against DDoS Amplification Attacks

Note: A few months after the original guide was published, protection against this vulnerability was added to both Mitch’s repository and voron00’s version of libcod. If you are using an up-to-date version from either of these repositories, this section is generally no longer required.

Older versions can be abused for DDoS amplification attacks. To prevent this, you should configure the appropriate iptables rules.

Create the following file:

#!/bin/bash

# Carry out specific functions when asked to by the system
case „$1“ in
start)
iptables -N QUERY-BLOCK
iptables -A QUERY-BLOCK -m recent –set –name blocked-hosts -j DROP
iptables -N QUERY-CHECK
iptables -A QUERY-CHECK -p udp -m string ! –string „getstatus“ –algo bm –from 32 –to 41 -j RETURN
iptables -A QUERY-CHECK -p udp –sport 0:1025 -j DROP
iptables -A QUERY-CHECK -p udp –sport 3074 -j DROP
iptables -A QUERY-CHECK -p udp –sport 7777 -j DROP
iptables -A QUERY-CHECK -p udp –sport 8002 -j DROP
iptables -A QUERY-CHECK -p udp –sport 27015:27100 -j DROP
iptables -A QUERY-CHECK -p udp –sport 25200 -j DROP
iptables -A QUERY-CHECK -p udp –sport 25565 -j DROP
iptables -A QUERY-CHECK -m recent –update –name blocked-hosts –seconds 30 –hitcount 1 -j DROP
iptables -A QUERY-CHECK -m hashlimit –hashlimit-mode srcip –hashlimit-name getstatus –hashlimit-above 5/second -j QUERY-BLOCK
iptables -A INPUT -p udp –dport 28960 -j QUERY-CHECK
;;
stop)
exit 0
;;
*)
echo „Usage: /etc/init.d/anti_ddos {start|stop}“
exit 1
;;
esac

exit 0

and insert the contents provided in the original guide.

If you are running multiple CoD2 servers, change this line:

iptables -A INPUT -p udp –dport 28960 -j QUERY-CHECK

to something like:

iptables -A INPUT -p udp –dport 28960:28970 -j QUERY-CHECK

This limits each client to five status queries per second, which is more than sufficient for legitimate server queries while preventing your server from being abused as a DDoS amplification source.

After saving the file, make it executable:

chmod 500 /etc/init.d/anti_ddos

Then enable it during system startup:

sudo update-rc.d anti_ddos defaults

To verify that everything is working correctly, start the service twice:

sudo service anti_ddos start

If the second execution returns the message „chain already exists“, the firewall rules have been configured successfully.

---