View Single Post
C0nw0nk
Senior Member
Join Date: May 2011
Location: United Kingdom
Old 08-02-2012 , 04:54   Re: SRCDS Windows Firewall Security / Hardening
Reply With Quote #5

Quote:
Originally Posted by nomy View Post
Using Windows Server 2008 R2 SP1 x64.

Its definitely some sort of flood. As soon as I restarted server it continued. I had to stop the server for sometime and check if the spam had stopped. It eventually stopped.

I called it DDoS because I saw multiple server IPs in that console spam i think most were cs1.6 servers from Russia. Of course IPs can be spoofed under UDP packets.

I don't have a hardware firewall, it costs too much to setup from datacenter and not planing for one either.
Then yes you are definitely under a form of DDoS I also cross referenced the IP addresses in your log they are infact other game servers Have you instaled any of the recommended plugins ?

Quote:
Originally Posted by C0nw0nk View Post
Stage 4 :
Recommended plugins / Addons to fight hackers, laggers and malicious people who connect to your server :

Drunken_F00l's | DAF (Dos Attack Fixer) Blocks exploits with specific "A2S" Packets in SRCDS.
http://www.sourceop.com/modules.php?...p=getit&lid=37

asherkin | ServerSecure (Files only) - Server protection against the Upload / Download exploit.
http://forums.alliedmods.net/showthread.php?t=142249

GoD-Tony | SourceMod Anti-Cheat - Prevents Hackers scripters spammers and cheaters.
http://forums.alliedmods.net/showthread.php?p=1637640

Liam | HPK High Ping Kicker Lite Edition - Enforce a maximum ping upon players to prevent server lag.
http://forums.alliedmods.net/showthread.php?p=701420

devicenull | Rcon Locker / Exploit Fixer (only works with "rcon_password" enabled)
http://forums.alliedmods.net/showthread.php?p=841590

Forlix | Flood Checker - Prevents flooding / spamming of console chat and the server itself.
http://forums.alliedmods.net/showthread.php?p=779851

Dr. McKay | How to get -autoupdate to work on Windows (Keeping your srcds server up to date)
http://forums.alliedmods.net/showthread.php?t=173487

KyleS | Create Edict Fixer
http://forums.alliedmods.net/showthread.php?t=186830

Query Caching protecting the server from A2S_INFO DoS attacks
Metamod version (ivailosp) | http://forums.alliedmods.net/showthread.php?t=135543
Sourcemod version (Zephyrus) | http://forums.alliedmods.net/showpos...&postcount=110
If you instal some of them especialy the DoS fixers it could help decrease the potential impact of the attack the other thing is to follow the windows firewall settings and block all the packet types you are not using other than TCP and UDP, As shown in Stage 1, Step 3.

You can also download the .zip file i added what has some tools init for your windows registry to prevent flooding of packet types.
__________________

Last edited by C0nw0nk; 08-02-2012 at 04:56.
C0nw0nk is offline
Send a message via MSN to C0nw0nk