search

doctorray117 / minecraft-ondemand

Templates to deploy a serverless Minecraft Server on demand in AWS
Apache License 2.0
1.68k stars 115 forks source link

DNS record is constantly spammed so the server is always running #45

Closed fridaystreet closed 2 years ago

fridaystreet commented 2 years ago

Just wondering if anyone has had this happen. After a while of having the system setup, the service started coming up and down like a yo yo when we weren't using it. I checked the logs and the domain name is getting hit all the time.

I assumed it's just hackers port scanning and trawling to find servers etc, but it's kinda made the auto start feature unusable. But just wondering if I'm missing something?

Any other ideas on easy ways to setup some sort of autostart function?

Cheers

doctorray117 commented 2 years ago

I would take a look at your cloudwatch DNS logs (the one triggering the startups) and see what the source IPs are possibly hitting it. It can't really be (under normal circumstances) port scanning as that is generally done directly and with IPs whereas iterating through subdomains would be more of a targeted attack on your domain. It may be coming from an IP within your control that's keeping tabs on the domain (like a background window of chrome browsed to it) or something. Usually just swapping to a different name would do the trick otherwise.

The DNS startup is nice-ish because it doesn't require any action other than opening the game. If you've shared the name with friends, it may also start up any time they open the multiplayer server selection interface. There are other ways to maintain control over the start/stop but so far this is the only one identified that is fully automatic. You could also do it with a text message or a button on a webpage or a secret api call you double click on your desktop before starting up minecraft, each of which could be directed at the startup lambda and you'd just turn the dns trigger off.

fridaystreet commented 2 years ago

it's not an IP from my location. I'll try changing the dns name to something else see if that helps.

Yeah I thought about having somehting more manual like secured webpage or something. I mean yeah, it's the easiest way to have it automated, but if this keeps happening it's a bit of a pain. Might have a look into starting via email or sms to trigger the lambda function.