-1

I'm getting attacks on my Debian server (DDos). They send massive amounts of packets to the same port, every packet got the same size. They send millions of packets with different ips to one of my ports with 46 bytes.

Is there a chance to block packets to same port with same size after some packets. So the server rejects every packet with 46 bytes on port 22 for 5 minutes after 100 packets came to port 22 with 46 bytes in less than 1 second.

emre1702
  • 13
  • 2

1 Answers1

0

The rule you are looking for is :

iptables -A INPUT -p tcp --dport 22 -m length --length 46 -m limit ! --limit 100/s -j DROP

Although, it won't help if you are facing a volumetric attack and your link is saturated.

setenforce 1
  • 186
  • 3