DDOS attack mitigation on Centos 7 WHM hosted on Hetzner
My server is under DDOS attack since a week now, every day, two to three times a day, for as long as 2 to 5 hours.
During the attack is very hard, close to impossible to access the WHM admin. I have tried most of the common mitigation solutions I could find. I installed CSF, made all the necessary settings for SYN FLOOD, and UDP attacks.
Currently I am working on using fail2ban with iptables as instructed here, but the fail2ban log does not show any taken action during the attack.
The only way I can access the server is by the Hetzner provided console, where I can also see a graphic that depicts the attack. I have tried to contact them, as they are advertising DDOS protection, but they told me that the attack is to small to be detected by their protection methods and that I have to mitigate this myself - they were the ones that suggested the ip2ban solution. Given the below provided log and graphic, is there anybody that could tell me what am I doing wrong or give me suggestion on how to try overcome this situation?
I had similar issues with my dedicated server with a different hoster. They were using Voxility-IPs. Voxility is a DDoS protection provider which helps to mitigate DDoS attacks. We've been attacked multiple times when we were using the old hoster.
But unfortunately the attack came from an attacker with more than 4 million Telekom proxies, and he reached about 500,000 connections per second on our server and flooded our server, so it was not useable anymore. I've contacted my hoster at this time, and they said, the attack is not a usual one, that's why I had to use tcpdump to record the network traffic during the attack. Then they could send this to Voxility to analyze the traffic and optimize their AI. Its task is to analyze the traffic before it decides if it's suspicious and needs to be mitigated or not.
I would recommend doing the same. You could record the traffic of the attack using tcpdump and download the .pcap file and open it with Wireshark. Then you could see the source IP-Addresses and set a firewall rule set (UFW is a local firewall on the server) using UFW to deny requests coming from the attackers IP-Addresses.
If you need any help, feel free to reach out to me!
- Would GCC 4.8 and 4.7 Peacefully Coexist on the Same Machine?
- How to use Cython to compile Python 3 into C
- What does 'low memory' mean in Linux?
- What is the difference between alpine docker image and busybox docker image?
- Using awk to print all columns from the nth to the last
- How to CORRECTLY install gsl library in Linux?
- Linker error : undefined reference to _fbss
- Shell - Write variable contents to a file
- Linux: Starting a GUI application from an init.d daemon
- How to kill a process running on particular port in Linux?
- Linux bash: Multiple variable assignment
- terminal giving prefix : To-be-filled-by-O-E-M
- Move file only if it exists
- Pipe only STDERR through a filter
- what is general semaphores range?
- Dummy output (sound) in Ubuntu 20.04.5 after doing sudo apt update
- Copying devices in Linux
- New Yocto Recipe Builds but Work Directory is Deleted after Compilation
- How to update github token on linux?
- error while running lighttpd in any way, such as status 255, or invalid characters
- how to separate an audio file based on different speakers
- How dynamic linking works, its usage and how and why you would make a dylib
- I can load functions from dynamic library with linking this dl ,but I can not load it using 'dlsym' in the code without linking this dl
- Took C/C++ code from Linux to Windows is really slow
- Unable to grep output of a command in bash script
- How do find specific string in file?
- Real-time display of `date` changes on Linux
- The following signatures couldn't be verified because the public key is not available while updating sudo apt update
- MariaDB Not Starting: "Plugin 'FEEDBACK' is disabled."
- vim cursor style persists on terminal after quitting vim