<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: times new roman,new york,times,serif; font-size: 12pt; color: #000000'>I posted this on the Ubuntu forums, as I've had good luck there in the past, but I think this question goes beyond the scope of most of the members there. Anyway, I copy/pasted for the sake of time, but here goes:<br><br>____________________________________________________________________________________________________________________________________________________<br><br><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">A friend of mine recently took me down using a DDOS. I know there isn't really a fool-proof way to safeguard against this, but it got me thinking about beefing up my security a bit. <span style="font-size: 12pt; ">From what my logs show, the 'attack' came from 4 IPs for about three minutes. </span><span style="font-size: 12pt; ">I did some research, and a script/program called "DDOS-Deflate" is about the best I can find for this sort of thing. It basically checks how many connections a given IP has, and if it's over a certain amount in a period of time, the IP gets blacklisted via iptables.</span></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><span style="font-size: 12pt; "><br></span></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">This all seems like it should work fine, but I ran some tests, and it's not catching things the way I'd like it to.<br><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">My system configuration is as follows:</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">-Ubuntu 12.04 running Shorewall, acting as firewall and router via 4-port ethernet card</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">--Apache server in Debian LXC container</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">--Postgre server in Debian LXC container</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">--Email server (Postfix/Dovecot) in Debian LXC container</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">Each of the containers runs through a common network bridge (br0) which Shorewall then turns into a subnet that holds just my containers. Each port of the 4-port NIC also runs it's own subnet. For the sake of this example, lets say I have the following (eth0-3 are on the add-on NIC, eth4 is the motherboard):</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">br0: 192.168.9.255</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">eth4: external IP (modem)</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">eth3: 192.168.3.255</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">eth2: 192.168.2.255</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">eth1: 192.168.1.255</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">eth0: 192.168.0.255</blockquote></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote>The problem is that when I try to run a DOS attack against my Apache server (in the DMZ, all requests to 8080 forwarded to it), the DDOS-Deflate script doesn't seem to see the connections being created. I haven't tested it from the outside yet, but I'd expect similar results. <span style="font-size: 12pt; ">I looked around a bit on Google, and had a peek at /usr/local/ddos.conf and /usr/local/ddos.sh </span><span style="font-size: 12pt; ">For those unfamiliar with DDOS-Deflate, it can be found at this address: http://deflate.medialayer.com<br></span><br>The line in the script that actually checks the connections looks like this (actually, this is a patched one I found online, as the one that comes with the script has a problem - https://mangesh7rhcss.wordpress.com/2011/03/02/dos-deflate-installation):<br><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><b>netstat -ntu | grep ':' | awk '{print $5}' | sed 's/::ffff://' | cut -f1 -d ':' | sort | uniq -c | sort -nr > $BAD_IP_LIST</b></blockquote></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">So, I ended up running a DOS attack a few times from my development box (192.168.30.255) to the server, and testing how many connections this script was seeing by manually running netstat on the server via SSH from the dev box. To my dismay, the only connections that it saw from my dev box to the server were the 3 SSH connections I had open in various terminals.</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">Apparently, my Shorewall rules are forwarding the requests immediately to the web server container before DDOS-deflate has a chance to analyze the traffic?</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br>Any other ideas? I'm kinda shooting in the dark here. That's all I can think of though, as even if I simply open a web page (dev box to server's web server container), and then run netstat on the host OS of the server (via SSH), it still doesn't see my HTTP connection in the netstat list - only the open SSH connections. </blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br>My only idea is to move the DDOS-deflate script to inside the containers, and see if it catches rogue traffic there, after it's been forwarded to the container by Shorewall. I was hoping having it installed on the host OS would have worked...</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br>Sorry for the lengthy post...let me know if I can clear anything up.</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">____________________________________________________________________________________________________________________________________________________</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">Long story short, I think the requests are being forwarded to my LXC containers before the DDOS script can even think about it. My thought is that since the connection is being made to the container's IP address, and not the host address, the netstat command is not detecting the connection?</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">Maybe I'm way off base, but whenever the Ubuntu community fails me, the LXC users usually have some valuable input....here's to hoping someone else has a similar config....</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><br></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">-Pat</blockquote></div></body></html>