Can someone pls tell what to do when a large DDOS attack (~40k requests from many IPs of one Country during one day) happens? I closed all ports on the firewall, reset the gateway and the attack stopped for now. Involved seems to be a Turkish hoster, Keyubu, but there are also other IP’s involved. Due to the fact that there a lots of different networks the attack came from I wonder how to get rid of those unfriendly people for now.
[Edit]
Anytime I close port 443 on iPFire, the port 443 requests from Turkey stop, as soon as I open port 443 again, they immediately flood the firewall log. However, most of them are blocked anyway.
I shut down my LAN infrastructure such as the server on the DMZ in Orange but above behavior keeps still to be the same. So I assume this comes from outside only?
BTW, I have blocked Turkey in Country Block as a whole anyway but the internet gets slow.
Excellent point., one of the consequences of DoS is that your firewall has to keep up with the responses, and rejecting a packet gets taxing. It’s not even worth to respond to a DoS packet, so I like DROP.
Another issue will be 40 000 + entries in your logs, so keep the firewall cool and check on your flash storage health..
However, when I close port 443 on iPFire, the traffic stops immediately, when I open it again, Port 443 requests start immediately again, independently if or if not the DMZ server in Orange is online; so I assume this one is not causing those requests.
Isn’t that a bit strange? Shouldn’t the logs continue with DROPs instead of silence? How do they know the firewall ports are closed?
[Edit] Ok, it seems that the DROPs are not logged, dependent on the firewall state. I’ve now disabled location block and enabled a specific country list covering my home country only at the moment and the logs are calm now.
Good morning Pike, I’ve reported for two ASN’s yet. The latter from today morning, AS209604 5.10.223.0/24, is presumably located in Germany, so I just tried there with (filtered) text logs attached. However, the other one directly located in Turkey from yesterday didn’t report back anything yet.
Amazon AWS is much better with these types of inquiries. I’ve had request floods two times from there and they mitigated within 24 hours each after reporting.
I don’t understand the Problem. Attacks happen everywhere every Day, especially on port 443/HTTPS – isn’t it the job of a Firewall to block them? If you offer services on TCP port 443, some people will try to get in
Much ado about nothing ^^
You’re fighting Windmills there – if you want to report every IP Range, you’ll be doing nothing else for the next few Months
On some sort of status description, you’re close to be correct on every point.
but on this one
in my opinion you got a blatant “miss”.
While run by some hardware, firewall distros are software, and every feature can be configured to log, diagnose, react (or not) to behaviours outside own network, the big bad messy and hostile internet.
Therefore is firewall admin job to create monitors, review logs, do evaluation and… act for reducing attack surface or disable possible bad threats to coming in or create issues.
So if it’s not intende port 443 to be accessed outside specific countries, why not avoiding “unnecessary noise” outside the expected traffic source?
IMVHO this is not true for the most part.
It’s a tiring game to report the range to range owners, that might (or not) consider to terminate contract with customers that are behaving… bad. Probably bad actors will find other services to rent (there’s everywhere in the world someone looking for more money) but if the customer will cost more money for managing issues than revenues? Who knows?
Not reporting and not reacting will create, in time, more troubles. Sometimes uncalled.
Sure you are right. From my perspective I do not feel comfortable with logs covering ten thousands of entries per day. So I created this mitigation list to avoid heavy logging (hits part of this list are not logged). My web site in the DMZ has usually two or three hits a day including crawlers so I’m sure you can feel after my fears to becoming a possible member of a Turkish botnet.
Funny, now they added some single Amazon AWS IP’s from India and other Turkish subnets spamming me full with port 443 requests …
[Update]
Interesting, I must correct myself. AWS India stopped late this afternoon; other EU countries as well. Looks like as if Turkey and some related countries (the US, for example) remain.
Maybe the informations on the following pages will help you decide whether to drop or reject.
