#How to prevent udp attack from OVH

137 messages · Page 1 of 1 (latest)

uneven agate
#

Block the IP's in network firewall at your ovhcloud panel. Or the entire range.

bold whale
uneven agate
#

Then report the IPs for DDoS

#

the accounts involved will be suspended if intentional

uneven agate
#

just allow your gateway

bold whale
uneven agate
#

I'd only block abusive subnets

bold whale
uneven agate
#

that list includes ovhcloud stuff

#

not only customer ranges

#

so its more risky

#

just block as they happen

#

you can check which IP belongs to which range

#

and block the range

#

remember to report the IPs too

#

this way it gets more expensive and hard for the attacker

#

he will have to use resellers and the resellers will blacklist him as they also get banned.

#

eventually he is left with no means to gain ovhcloud services to use with attacks.

#

the reports also allows abuse team to learn new type of attack traffic

#

this will then get fingerprinted and added to automatic suspension list eventually.

bold whale
#

hmmm

bold whale
bold whale
uneven agate
uneven agate
#

then view IPs with wireshark

#

from the dump file.

bold whale
#

U there?

#

If I block both my OVH vps ip is it still good? or do i need to leave that netblock out?

uneven agate
#

Just try it

#

remove if it fails

#

You can't really permanently ruin anything

#

just reverse the changes if it fails.

bold whale
#

so the attack from OVH udp will not affect ?

#

Did I block correctly?

bold whale
bold whale
#

.

#

@uneven agate sorry for tag

#

plz rep me

uneven agate
#

You need to define source ip

#

otherwise it blocks everything

bold whale
#

i only allow port 25565 (minecraft) and block all

#

but

#

I mean

#

does it work when the attack is coming from OVH?

#

"ovh's antiddos" will "not work" when "attacking from OVH"

uneven agate
#

I would assume that it includes all traffic, as those are public IPs too. You could also specifically add the offending subnets with ipv4 rule if that above fails.

bold whale
#

bruh

uneven agate
#

hence you use 1.2.3.4/18

#

for example

#

to include entire subnet.

bold whale
uneven agate
#

rule ipv4 includes all protocols under ipv4

#

so it covers UDP, TCP

#

and so on.

bold whale
#

so i'll try to block some of ovh's netbock

uneven agate
#

Only if current settings fail you

#

And not random ranges, that would be useless

bold whale
#

i know

uneven agate
#

setup automatic tcpdump

bold whale
#

i try test

uneven agate
#

do you need script for that?

#

That allows you to record offending ip's

bold whale
uneven agate
#

Its simple, and theres nothing extra

#

The code is less than 20 lines and easy to audit as long as you trust the packages it calls such as "tcpdump".

bold whale
#

I run it in linux ?

#

and can it detect udp attack from OVH?

#

right?

uneven agate
#

It simply records x amount of network traffic in packets when the attack starts and is on peak

#

and writes the record to .pcap file

#

whichever is the attacker, you can see with wireshark

#

it also shows the attack types if you know how to read it further.

bold whale
#

you mean

#

20,000kb = 20mb?

uneven agate
#

PPS

#

as in network packets

#

You wish to know the offending subnets, and that script is a tool to record any traffic during the attack to help you determine them.

#

Its not limited to OVH

#

You can use it with any linux and it can record any ip.

bold whale
#

ok

#

but important

#

Whether IPv4 can prevent it from the OVH attack or not is important

#

Firewall network will it work if ddosed from OVH?

uneven agate
#

You can find all information in here 🙂

#

and you can always change the configurations and try different settings if something is not immediately working for you.

bold whale
#

Can I ask you something

#

Is there a way to let it remove the optional ips?

#

like i don't want it to capture ip 123.123.123.123

uneven agate
#

that is irrelevant as it only captures about 1 second or less during the attack

#

20k packets is pretty fast captured if theres an ongoing attack

#

you can edit the command though and exclude or include only some stuff or protocols if you check tcpdump command examples

#

but I see no use in that myself

#

generally you'd browse to middle of the file in wireshark and look whats the most recurring stuff in the file.

#

and ignore rest to determine whats the attack about

bold whale
#

Ok

bold whale
#

Hi @uneven agate

#

Refuse Protocol IPv4 is to block all protocol like TCP, UDP, ICMP, AH, GRE, ESP, ..... right?

bold whale
#

Plz rep me

uneven agate
#

You can use that as priority 19

#

and set allow rules to priority 0-18

#

this way it only allows what you set to 0-18

#

and blocks everything else with 19 rule

bold whale
#

thank u so much

uneven agate
#

No problem 🙂

bold whale
#

why OVH only allow set 20 rules

#

can i set more 20 rules?

uneven agate
#

Only 20 rules per IP is allowed for now

#

this may or may not change in future.

#

I do not know the reason myself, but if I had to guess, it has to do with performance. Your's IP is not the only one that has rules on it, and OVHCloud has millions of them with a lot of rules on many, and these rules are mirrored across the globe.

#

You can make best use of 20 rules fairly easy to achieve almost anything

#

You don't need to make many block rules in general. 1 is enough

#

Then have 19 rules for allowing whatever you need.

bold whale
#

yes

#

i refuse all ipv4 priority 19

#

but the ddos ip will get in what i accept

#

ex: ip 123.123.123.123 attack port 25565 (i accepted port 25565)

#

and many other different ips

#

23.0000000

#

43.000000

#

...

uneven agate
#

Is it always single IP

#

or something else

bold whale
#

How to report ip ovh ddos ?