Linux Iptables writing new rule for limit a DoS Attack

Question

Recently, I have experienced a DoS attack so i decide write a new rule to stop the attack but my knownledge is not enough to do this,

so any hint or help will be appreciated

Attack log attachment-ed below, Also my current tables is attached too

My Rules:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
# Allow LoopBack
-A INPUT -i lo -j ACCEPT

# Allow New Connection Only On Ports ( 22 - 3724 - 3799 ) And Maximum Connection Limited At 15
-A INPUT -i eth0 -p tcp -m multiport --dports 22,3724,3799 -m state --state NEW,ESTABLISHED -m connlimit --connlimit-upto 15 --connlimit-mask 32 --connlimit-saddr -j ACCEPT

# Allow Ping ( Only 2x Ping Per a Sec )
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 2/sec --limit-burst 2 -j ACCEPT

# Allow LoopBack
-A OUTPUT -o lo -j ACCEPT

# Allow Established Connection
-A OUTPUT -o eth0 -p tcp -m multiport --sports 22,3724,3799 -m state --state ESTABLISHED -j ACCEPT

# Allow Ping ( Only 2x Ping Per a Sec )
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 0 -m limit --limit 2/sec --limit-burst 2 -j ACCEPT
COMMIT

Attack Log: http://paste.ubuntu.com/12019024/

Also if my rules need rewrite/edit tell me

Thank you

Writing an iptable rule will usually do nothing to mitigate a DDoS, since the connection TO your server will still be overloaded, which makes your server unreachable for normal traffic. — dadriel, Aug 07 '15 at 07:27
Ok, looks like your server is not the _victim_ but the _attacker_. I suggest you check what happens on the server rather than losing your time with iptables. Maybe check [How to deal with a compromised server](http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server) — Oliver, Aug 07 '15 at 07:33
whole attacker have same mac-address, all those ips are on same machine, I think it called fake ip address — DarkOne, Aug 07 '15 at 09:17

score 1 · Answer 1 · edited Apr 13 '17 at 12:14

According to your log, the SYN packets are originating in your loopback interface and your eth0 is sending SYN ACK in response to a lot of random public IPs. As @Oliver pointed out in the comment above, your server may be compromised. I would remove server off the network and look into how to rectify a compromised server.

http://www.ducea.com/2006/07/17/how-to-restore-a-hacked-linux-server

How do I know if my Linux server has been hacked?

https://major.io/2011/03/09/strategies-for-detecting-a-compromised-linux-server/

Linux Iptables writing new rule for limit a DoS Attack

1 Answers1