One of my Linux Server (Cent OS, cPanel) is under syn floods Attacks come from different spoofed ip addresses and ports as below logs.
root@yes [~]# netstat -n -p | grep SYN_REC | sort -u
tcp 0 0 66.7.221.78:80 109.230.222.43:19324 SYN_RECV -
tcp 0 0 66.7.221.78:80 109.243.238.214:51875 SYN_RECV -
tcp 0 0 66.7.221.78:80 109.243.238.214:51877 SYN_RECV -
tcp 0 0 66.7.221.78:80 109.243.238.214:51881 SYN_RECV -
tcp 0 0 66.7.221.78:80 109.67.0.116:1864 SYN_RECV -
tcp 0 0 66.7.221.78:80 110.138.179.58:2130 SYN_RECV -
tcp 0 0 66.7.221.78:80 110.138.179.58:2588 SYN_RECV -
tcp 0 0 66.7.221.78:80 110.138.179.58:2986 SYN_RECV -
tcp 0 0 66.7.221.78:80 110.138.179.58:3162 SYN_RECV -
tcp 0 0 66.7.221.78:80 110.138.179.58:3296 SYN_RECV -
tcp 0 0 66.7.221.78:80 117.200.155.197:3742 SYN_RECV -
tcp 0 0 66.7.221.78:80 117.200.155.197:4116 SYN_RECV -
tcp 0 0 66.7.221.78:80 118.175.74.56:44640 SYN_RECV -
tcp 0 0 66.7.221.78:80 118.175.74.56:44663 SYN_RECV -
tcp 0 0 66.7.221.78:80 118.175.74.56:60025 SYN_RECV -
tcp 0 0 66.7.221.78:80 118.96.143.54:49278 SYN_RECV -
tcp 0 0 66.7.221.78:80 119.148.10.218:49468 SYN_RECV -
tcp 0 0 66.7.221.78:80 122.164.96.85:2034 SYN_RECV -
tcp 0 0 66.7.221.78:80 125.167.233.138:38001 SYN_RECV -
tcp 0 0 66.7.221.78:80 125.167.233.138:40720 SYN_RECV -
tcp 0 0 66.7.221.78:80 125.167.233.138:54342 SYN_RECV -
tcp 0 0 66.7.221.78:80 128.10.19.52:49852 SYN_RECV -
tcp 0 0 66.7.221.78:80 128.187.223.212:44272 SYN_RECV -
tcp 0 0 66.7.221.78:80 128.220.231.2:37871 SYN_RECV -
tcp 0 0 66.7.221.78:80 129.110.125.52:40194 SYN_RECV -
tcp 0 0 66.7.221.78:80 129.130.252.141:48734 SYN_RECV -
tcp 0 0 66.7.221.78:80 129.82.12.188:55490 SYN_RECV -
tcp 0 0 66.7.221.78:80 131.179.150.72:49705 SYN_RECV -
tcp 0 0 66.7.221.78:80 137.165.1.115:43573 SYN_RECV -
tcp 0 0 66.7.221.78:80 141.219.252.133:44643 SYN_RECV -
tcp 0 0 66.7.221.78:80 149.135.70.236:29968 SYN_RECV -
tcp 0 0 66.7.221.78:80 149.135.70.236:38562 SYN_RECV -
tcp 0 0 66.7.221.78:80 164.107.127.13:51938 SYN_RECV -
tcp 0 0 66.7.221.78:80 169.229.50.12:47415 SYN_RECV -
tcp 0 0 66.7.221.78:80 169.229.50.15:51748 SYN_RECV -
tcp 0 0 66.7.221.78:80 169.229.50.15:51782 SYN_RECV -
tcp 0 0 66.7.221.78:80 169.229.50.18:44910 SYN_RECV -
tcp 0 0 66.7.221.78:80 170.140.119.70:33785 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.14.76.218:64671 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.17.218.10:21347 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.212.238.60:41009 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.218.74.187:50490 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.236.86.178:38248 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.236.86.178:38546 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.236.86.178:38556 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.236.86.178:46806 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.236.86.178:46809 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.236.86.178:47387 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.242.125.196:37477 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.68.57.13:60290 SYN_RECV -
tcp 0 0 66.7.221.78:80 173.86.120.225:60333 SYN_RECV -
And goes on... ...
The total number of attacked ips are 576 today, this was 1024 on yesterday.
The total number of attacked ips are 576 today, this was 1024 on yesterday.
#root@host [~]# netstat -n -p|grep SYN_REC | wc -l
576
I've used CSF (ConfigServer Firewall) but is not protecting. I've set parameters below
+ High Security Level:
Code:
SYNFLOOD = 1
SYNFLOOD_RATE = 1/s
SYNFLOOD_BURST = 3
When it is running, I am not able to login to the server, all services are down, and so I stopped it. Also inetbase ddos script is not working...
This solution worked until today because attacker increased spoofed ips.
Also I am using iptables for filter incomming TCP-SYN requests. My iptables are below:
Code:
# Limit the number of incoming tcp connections
# Interface 0 incoming syn-flood protection
iptables -N syn_flood
iptables -A INPUT -p tcp --syn -j syn_flood
iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A syn_flood -j DROP
#Limiting the incoming icmp ping request:
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
iptables -A INPUT -p icmp -j DROP
iptables -A OUTPUT -p icmp -j ACCEPT
I've limited incomming TCP requests on port 80 by iptables:
Code:
iptables -I INPUT -p tcp -m state --state NEW --dport 80 -m recent --name http_flood --set
iptables -I INPUT -p tcp -m state --state NEW --dport 80 -m recent --name http_flood --update --seconds
10 --hitcount 3 -j DROP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
It should be useful to prevent flood SYN_RECV attack on Linux server, You can try this at your own risk
Thank You