DNS BLACKHOLE
-
Hey, so my ISP can't do anything about DDOS, they can offer blackhole on ddos, but that block all communications with outer world. So i need pfSense to blackhole some of the ip that are ddosing, maybe auto block? Thanks, i really need that!
-
In true DDOS scenarios, such as massive inbound ICMP attacks, you usually have no recourse except to refer it back to the carrier (ISP). If you're getting floods of specific traffic - such as HTTP - from blocks of addresses, you could set up drop rules against those address ranges for that traffic type. What kind of hits are you getting, and do you have any sample logs you could post?
-
Currently i just moved from shitty isp router to pfsense, i have UDP flood maximum 300mb/s, my network speed is 100mb/s, my isp said i can configure myself, and still have pretty stable connestion under ddos.
-
so your seeing 300mbps to your 100 mbps connection, how exactly can you do anything about that on your end? When the packets have already been sent down the pipe too you??
-
Im telling what i heard, my isp said blackhole can be activated at my router that's it. So it means there is a way.
-
Or the guy you were talking to at the ISP is an idiot or didn't understand your question or the issue at all.
If what is sending the traffic is finding your IP via dns entry, then you could set this fqdn to blackhole, you could setup views on your dns to only allow specific IPs to look up the actual IP.
your ISP determines that traffic to IP 1.2.3.4 goes down your pipe to your equipment.. Once they send that traffic down that pipe nothing you can do on your end can remove the issue that the pipe is full!!!
You need to keep the traffic from going down your pipe, if he bad guys are finding this IP via dns - then sure you could alter your dns to point somewhere else, loopback, etc.. But if they are sending the traffic to your IP you have 2 choices.. Change IPs so that IP is not sent down your connection by your isp.. Or have the isp not send the traffic..
-
Ain't solution, okay, i have server i got ddosed, he said blackhole fix that.
-
Ain't solution, okay, i have server i got ddosed, he said blackhole fix that.
Personally, I'd find another ISP.
-
well "www.teo.lt" Is best internet provider in Lithuania, it even beats some other Europe countries, so i'd say it's okay. :)
-
yes the isp could blackhole the traffic that is doing the ddos against you… You can not.. even if you drop/blackhole it which is the default firewall rule anyway.. if your pipe is only 100mbps, and there is 300mbps of traffic its useless to drop the traffic.. You can not suck and elephant through a straw..
-
DAMN IT!
-
It really such a basic concept fail to see why users think that a firewall can help against a DDOS based upon a traffic flood..
You have internet (HUGE Amounts of bandwidth) –-- isp --- 100 mbps --- You
What happens when 4 lanes of traffic on the highway go down to 1 lan... So internet/isp is a 8 lane super highway... And there is a single lane dirt road down to your location.
If 4 lanes of cars all try and go down your dirt road.. That road is full now isn't it - does not matter if there is a ditch just before your house that they fall into.. The road is still full and the cars that that you want to get into your house have to wait through all that traffic, or maybe get dropped at the isp since the isp can only send so much traffic down the road, when its full no new cars can go down it... So traffic has to get dropped at their end... They can not just queue it all up and send it down later..
There is nothing you can do at your end with this sort of attack.. The isp has to control what traffic can go down your dirt road..
Now if it only say 10mbps of bad traffic, then sure you can just drop it at your firewall and not do anything with, don't send it on to your server behind, etc.. This is by default what pfsense does with traffic that does not match rules to be forwarded or allowed in. it just drops it (blackhole).. So sure if this bad traffic is not filling up your pipe, you can live with some noise/bad traffic taking up part of your bandwidth and sill be fine... But when they exceed the amount of traffic your pipe can handle does not matter what you do at your end with that traffic.. The good traffic just can not get to you, in the amount that they need to function correctly with the services your providing..
-
So there isn't any solutions hmm…. Well see i have MC, TS, and web server, if they decide to ddos at port 2555,80 they will come trough my pfsense to server box, which will overload network card, or not? Well i guess that's it.
-
If someone is sending more data at you that when you cant handle, you will get packetloss. The more data they send, the more packetloss you get. You have to block the excess data before it gets to you. If it's a DDOS, then your ISP can blackhole you. In other words, they will disconnect you from the Internet.
-
It's useless if i get disconnected i have pfSense, which protect my other servers being hit by ddos..
-
http://blogs.verisign.com/blog/entry/ddos_blog_series_1_4?cmp=blog
this explains it very well. but beware: its advertisement for verisign-cloud-ddos-mitigation
-
"if they decide to ddos at port 2555,80"
Well yeah.. But what does it matter if they are sending 300mbps down your 100mbps pipe… I thought I explained it quite well.. Your road is FULL!!!
If they were sending 10 or 30 or even maybe 50 or 75 even you could do something to ride out the storm by not forwarding that traffic through to your servers.. But its useless if its a load or volume based attack where they just overwhelm the capacity of your network connection..
In this sort of attack, the traffic has to be prevented from going down your connection... As again thought clearly stated, change your IP, get your isp to prevent the traffic!! Or use ddos cloud service like in the blog heper linked too..
-
"if they decide to ddos at port 2555,80"
Well yeah.. But what does it matter if they are sending 300mbps down your 100mbps pipe… I thought I explained it quite well.. Your road is FULL!!!
If they were sending 10 or 30 or even maybe 50 or 75 even you could do something to ride out the storm by not forwarding that traffic through to your servers.. But its useless if its a load or volume based attack where they just overwhelm the capacity of your network connection..
In this sort of attack, the traffic has to be prevented from going down your connection... As again thought clearly stated, change your IP, get your isp to prevent the traffic!! Or use ddos cloud service like in the blog heper linked too..
Thanks, sorry for that ;/
Well i have some strange issue, when using speed test's anything else, i get 100mb/s - What i pay for, but sometimes when i download files from torrent websites i manage to get 200mb/s (300mb/s rare), so will it might help against ddos, or dfq is this? Kinda network-speedstep (like intel cpu) ? :D
-
if your on a 100mbps connection, how would you get 200mbps from torrents? What is your connection you pay for?? And what is the actual physical interface connection, it is gig or 100?
-
I pay for 100mb/s Optimal Fiber, from TEO, My pc is gig, router(wi-fi) is 300mb/s with 5 ports i think.
