Prevent syn floods [SYN_RECV] attack on Linux (cPanel) Server

One of my Linux Server (Cent OS, cPanel) is under syn floods Attacks come from different spoofed ip addresses and ports as below logs.  

root@yes [~]# netstat -n -p | grep SYN_REC | sort -u

tcp        0      0 66.7.221.78:80              109.230.222.43:19324        SYN_RECV    -

tcp        0      0 66.7.221.78:80              109.243.238.214:51875       SYN_RECV    -

tcp        0      0 66.7.221.78:80              109.243.238.214:51877       SYN_RECV    -

tcp        0      0 66.7.221.78:80              109.243.238.214:51881       SYN_RECV    -

tcp        0      0 66.7.221.78:80              109.67.0.116:1864           SYN_RECV    -

tcp        0      0 66.7.221.78:80              110.138.179.58:2130         SYN_RECV    -

tcp        0      0 66.7.221.78:80              110.138.179.58:2588         SYN_RECV    -

tcp        0      0 66.7.221.78:80              110.138.179.58:2986         SYN_RECV    -

tcp        0      0 66.7.221.78:80              110.138.179.58:3162         SYN_RECV    -

tcp        0      0 66.7.221.78:80              110.138.179.58:3296         SYN_RECV    -

tcp        0      0 66.7.221.78:80              117.200.155.197:3742        SYN_RECV    -

tcp        0      0 66.7.221.78:80              117.200.155.197:4116        SYN_RECV    -

tcp        0      0 66.7.221.78:80              118.175.74.56:44640         SYN_RECV    -

tcp        0      0 66.7.221.78:80              118.175.74.56:44663         SYN_RECV    -

tcp        0      0 66.7.221.78:80              118.175.74.56:60025         SYN_RECV    -

tcp        0      0 66.7.221.78:80              118.96.143.54:49278         SYN_RECV    -

tcp        0      0 66.7.221.78:80              119.148.10.218:49468        SYN_RECV    -

tcp        0      0 66.7.221.78:80              122.164.96.85:2034          SYN_RECV    -

tcp        0      0 66.7.221.78:80              125.167.233.138:38001       SYN_RECV    -

tcp        0      0 66.7.221.78:80              125.167.233.138:40720       SYN_RECV    -

tcp        0      0 66.7.221.78:80              125.167.233.138:54342       SYN_RECV    -

tcp        0      0 66.7.221.78:80              128.10.19.52:49852          SYN_RECV    -

tcp        0      0 66.7.221.78:80              128.187.223.212:44272       SYN_RECV    -

tcp        0      0 66.7.221.78:80              128.220.231.2:37871         SYN_RECV    -

tcp        0      0 66.7.221.78:80              129.110.125.52:40194        SYN_RECV    -

tcp        0      0 66.7.221.78:80              129.130.252.141:48734       SYN_RECV    -

tcp        0      0 66.7.221.78:80              129.82.12.188:55490         SYN_RECV    -

tcp        0      0 66.7.221.78:80              131.179.150.72:49705        SYN_RECV    -

tcp        0      0 66.7.221.78:80              137.165.1.115:43573         SYN_RECV    -

tcp        0      0 66.7.221.78:80              141.219.252.133:44643       SYN_RECV    -

tcp        0      0 66.7.221.78:80              149.135.70.236:29968        SYN_RECV    -

tcp        0      0 66.7.221.78:80              149.135.70.236:38562        SYN_RECV    -

tcp        0      0 66.7.221.78:80              164.107.127.13:51938        SYN_RECV    -

tcp        0      0 66.7.221.78:80              169.229.50.12:47415         SYN_RECV    -

tcp        0      0 66.7.221.78:80              169.229.50.15:51748         SYN_RECV    -

tcp        0      0 66.7.221.78:80              169.229.50.15:51782         SYN_RECV    -

tcp        0      0 66.7.221.78:80              169.229.50.18:44910         SYN_RECV    -

tcp        0      0 66.7.221.78:80              170.140.119.70:33785        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.14.76.218:64671         SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.17.218.10:21347         SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.212.238.60:41009        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.218.74.187:50490        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.236.86.178:38248        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.236.86.178:38546        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.236.86.178:38556        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.236.86.178:46806        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.236.86.178:46809        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.236.86.178:47387        SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.242.125.196:37477       SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.68.57.13:60290          SYN_RECV    -

tcp        0      0 66.7.221.78:80              173.86.120.225:60333        SYN_RECV    -

And goes on... ...

The total number of attacked ips are 576 today, this was 1024 on yesterday.

#root@host [~]# netstat -n -p|grep SYN_REC | wc -l

576

I've used CSF (ConfigServer Firewall) but is not protecting. I've set parameters below

+ High Security Level:

Code:

SYNFLOOD  = 1

SYNFLOOD_RATE  = 1/s

SYNFLOOD_BURST  = 3

When it is running, I am not able to login to the server, all services are down, and so I stopped it. Also inetbase ddos script is not working...

This solution worked until today because attacker increased spoofed ips.

Also I am using iptables for filter incomming TCP-SYN requests. My iptables are below:

Code:

# Limit the number of incoming tcp connections

# Interface 0 incoming syn-flood protection

iptables -N syn_flood

iptables -A INPUT -p tcp --syn -j syn_flood

iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN

iptables -A syn_flood -j DROP

#Limiting the incoming icmp ping request:

iptables -A INPUT -p icmp -m limit --limit  1/s --limit-burst 1 -j ACCEPT

iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:

iptables -A INPUT -p icmp -j DROP 

iptables -A OUTPUT -p icmp -j ACCEPT

I've limited incomming TCP requests on port 80 by iptables:

Code:

iptables -I INPUT -p tcp -m state --state NEW --dport 80 -m recent --name http_flood --set

iptables -I INPUT -p tcp -m state --state NEW --dport 80 -m recent --name http_flood --update --seconds

10 --hitcount 3 -j DROP

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

It should be useful to prevent flood SYN_RECV attack on Linux server, You can try this at your own risk

Thank You

How to Find and Check Number of Connections to a Server

Whenever a client connects to a server via network, a connection is established and opened on the system. On a busy high load server, the number of connections connected to the server can be run into large amount till hundreds if not thousands. Find out and get a list of connections on the server by each node, client or IP address is useful for system scaling planning, and in most cases, detect and determine whether a web server is under DoS or DDoS attack (Distributed Denial of Service), where an IP sends large amount of connections to the server. To check connection numbers on the server, administrators and webmasters can make use of netstat command.

Below is some of the example a typically use command syntax for ‘netstat’ to check and show the number of connections a server has. Users can also use ‘man netstat’ command to get detailed netstat help and manual where there are lots of configurable options and flags to get meaningful lists and results.

#netstat -na

 
Display all active Internet connections to the servers and only established connections are included.

#netstat -an | grep :80 | sort

Show only active Internet connections to the server at port 80 and sort the results. Useful in detecting single flood by allowing users to recognize many connections coming from one IP.

#netstat -n -p|grep SYN_REC | wc -l

 
Let users know how many active SYNC_REC are occurring and happening on the server. The number should be pretty low, preferably less than 5. On DoS attack incident or mail bombed, the number can jump to twins. However, the value always depends on system, so a high value may be average in another server.

#netstat -n -p | grep SYN_REC | sort -u

 
List out the all IP addresses involved instead of just count.

#netstat -n -p | grep SYN_REC | awk '{print $5}' | awk -F: '{print $1}'

 
List all the unique IP addresses of the node that are sending SYN_REC connection status.

#netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

 
Use netstat command to calculate and count the number of connections each IP address makes to the server.

#netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

 
List count of number of connections the IPs are connected to the server using TCP or UDP protocol.

#netstat -ntu | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

 
Check on ESTABLISHED connections instead of all connections, and displays the connections count for each IP.

#netstat -plan|grep :80|awk {'print $5'}|cut -d: -f 1|sort|uniq -c|sort -nk 1

 
Show and list IP address and its connection count that connect to port 80 on the server. Port 80 is used mainly by HTTP web page request.

If you would like to prevent this kind of attack, you can configure the following IPTABLES rule on the server

#iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

#iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP