VPS port stress

[Sephere92 0]

Hello everyone.

We have some problem with our server. The login, and the ch1 is probably under attack because we and other players cant connect to the server, or just very hardly.

Syslog:

Feb 23 20:00:00.111679 :: SYSTEM: new connection from [84.236.40.24] fd: 17 handshake 1925189220 output input_len 0, ptr 0x4dcf1400
Feb 23 20:00:00.160869 :: SYSTEM: closing socket. DESC #18
Feb 23 20:00:00.201885 :: SYSTEM: new connection from [109.110.221.104] fd: 18 handshake 2943155996 output input_len 0, ptr 0x4dcf6800
Feb 23 20:00:00.240960 :: SYSTEM: closing socket. DESC #17
Feb 23 20:00:00.273052 :: SYSTEM: new connection from [87.97.61.204] fd: 17 handshake 3956694818 output input_len 0, ptr 0x4dcf1400
Feb 23 20:00:00.310969 :: SYSTEM: closing socket. DESC #18
Feb 23 20:00:00.361422 :: SYSTEM: new connection from [62.77.249.188] fd: 18 handshake 1069098724 output input_len 0, ptr 0x4dcf6800
Feb 23 20:00:00.401140 :: SYSTEM: closing socket. DESC #17
Feb 23 20:00:00.441694 :: SYSTEM: new connection from [87.97.82.166] fd: 17 handshake 174580450 output input_len 0, ptr 0x4dcf1400
Feb 23 20:00:00.481305 :: SYSTEM: closing socket. DESC #18
Feb 23 20:00:00.511402 :: SYSTEM: new connection from [109.105.0.116] fd: 18 handshake 2042924810 output input_len 0, ptr 0x4dcf6800
Feb 23 20:00:00.561209 :: SYSTEM: closing socket. DESC #17
Feb 23 20:00:00.591674 :: SYSTEM: new connection from [81.182.75.89] fd: 17 handshake 3901646441 output input_len 0, ptr 0x4dcf1400
Feb 23 20:00:00.641198 :: SYSTEM: closing socket. DESC #18
Feb 23 20:00:00.671312 :: SYSTEM: new connection from [87.97.49.29] fd: 18 handshake 3365341319 output input_len 0, ptr 0x4dcf6800
Feb 23 20:00:00.721087 :: SYSTEM: closing socket. DESC #17
Feb 23 20:00:00.763735 :: SYSTEM: new connection from [92.249.156.162] fd: 17 handshake 355866932 output input_len 0, ptr 0x4dcf1400
Feb 23 20:00:00.791010 :: SYSTEM: closing socket. DESC #18
Feb 23 20:00:00.841574 :: SYSTEM: new connection from [91.82.32.33] fd: 18 handshake 3024604938 output input_len 0, ptr 0x4dcf6800
Feb 23 20:00:00.881089 :: SYSTEM: closing socket. DESC #17
Feb 23 20:00:00.911602 :: SYSTEM: new connection from [94.44.252.207] fd: 17 handshake 4180896694 output input_len 0, ptr 0x4dcf1400
Feb 23 20:00:00.960884 :: SYSTEM: closing socket. DESC #18

We tried to protect the ports in ipfw, but it seems, it didnt work:

$IPF 226 allow all from any to any dst-port 12000,13000,13010,13099, in via em0 setup limit src-addr 10

Experience:

Our syserr, and syslog size is increasing every time after we start the server. If we change the ch1 port for example, It works well, but after a plenty of time it is down again and we cannot do anything against it.

Can anyone help up us?

 

 

[pollux 990]

Another solution: Block the IP's. This would minimize the threat.

I would look if those IPs are inside any range (all from one internet/server provider) and block all of those.