search

rehlds / ReHLDS

Enhanced version of the HLDS engine with bug fixes, security patches, and optimizations for stable servers.
https://rehlds.dev/docs/rehlds
GNU General Public License v3.0
667 stars 171 forks source link

flood udp port 27015 [Using Rehlds latest and Reunion Stable] #771

Open amsaal opened 4 years ago

amsaal commented 4 years ago

since 3 days i am getting flood on udp port 27015 running counter-strike 1.6

when attack is placed , my SSH / Ping and all other ports works but udp port 27015 is not responding and when you refresh you can see some players and after few seconds all gone and not responding.

i have attached a latest dump you can see it .

Please provide a fix .

hhhhhhhhh-WCS commented 4 years ago

that happened to us too , we got a big exploit on rehlds , we dont want solution for this problem only , we want to stop that completely

RauliTop commented 4 years ago

Meta list?

RauliTop commented 4 years ago

I recommend you to use last reunion dev version 0.1.0.135

Try it.

amsaal commented 4 years ago

I recommend you to use last reunion dev version 0.1.0.135

Try it.

reunion cannot stop flood attacks or expoits. reunion can detect and block but prevention i mean what i faced server was offline for like 2-3 hours ... my friend has exactly same reunion the one you highlighted to me having issue as me

hhhhhhhhh-WCS commented 4 years ago

I dont think change reunion version will help , as he said udp port 27015 not respond anymore

amsaal commented 4 years ago

I dont think change reunion version will help , as he said udp port 27015 not respond anymore

exactly we dont need solution we need a complete protection from this flood.

by the way its not DDOS as i said all ports are working but port udp 27015 is not responding due to flood.

Sonnyvhx commented 4 years ago

spoffffff

I think you're talking about this problem? and I'm looking for a solution and I can't find ..

hhhhhhhhh-WCS commented 4 years ago

[REUNION]: Blocking query flood from a lot of spoofed addresses: 26671 pps [REUNION]: Blocking query flood from a lot of spoofed addresses: 4366 pps [REUNION]: Blocking query flood from a lot of spoofed addresses: 4140 pps [REUNION]: Blocking query flood from a lot of spoofed addresses: 5209 pps [REUNION]: Blocking query flood from a lot of spoofed addresses: 4688 pps [REUNION]: Blocking query flood from a lot of spoofed addresses: 4465 pps [REUNION]: Blocking query flood from a lot of spoofed addresses: 4277 pps yea same problem

SkillartzHD commented 4 years ago

https://forums.alliedmods.net/showthread.php?t=296842

it's the same similar problem as here, you can't really block ip spoof attacks the only way would be to take all the ips and add them to the firewall

or we have seen a method in which if the client (attacker) does not socket.request to what it sends (socket.send with TSource Engine Query) then the packet will be returned to him, the only method could detect these attacks,

amsaal commented 4 years ago

https://forums.alliedmods.net/showthread.php?t=296842

it's the same similar problem as here, you can't really block ip spoof attacks the only way would be to take all the ips and add them to the firewall

or we have seen a method in which if the client (attacker) does not socket.request to what it sends (socket.send with TSource Engine Query) then the packet will be returned to him, the only method could detect these attacks,

can you tell which metamod ?

Sonnyvhx commented 4 years ago

does no one know any solution?

GoRiLliAz commented 4 years ago

Use anti-ddos game OVH he block that

Sonnyvhx commented 4 years ago

firewall and Anti-DDoS game is active and that problem persists

GoRiLliAz commented 4 years ago

OVH ? i have anti ddos game and this attack is block since 1 years if no contact ovh support or install server steam only

amsaal commented 4 years ago

how did they block?