+- -TWC| Forum (https://board.twcclan.org)
+-- Forum: Public (https://board.twcclan.org/forum-13.html)
+--- Forum: Important news (https://board.twcclan.org/forum-47.html)
+---- Forum: Server/forum changes (https://board.twcclan.org/forum-109.html)
+---- Thread: DDoS protection (/thread-6145.html)
DDoS protection - Ligustah - 14-01-2016
Hey there,
I finally got around to implementing some DDoS protection that should prevent any lags on the servers. The way it works shouldn't ever ban innocent players, though I obviously cannot guarantee that. Hence if you notice any connection problems or any other sort of network issue it may be due to this program, so please report it here.
More technical:
The program employs a simple technique called Token bucket. It will allow players or other servers (such as Trackbase/Gametracker) an average of 50 packets per second, while allowing bursts much higher for short durations. It only counts getstatus packets, which are those sent by most server browsers or when you click "server info" in the ET menu. If you are not using any of those programs, you will likely have less than 1 packet per second on average. For example, HLSW (the program I use for RCON stuff) tracks all servers that we have and uses less than 10 packets per second.
The kind of DDoS attacks that will lag the servers usually have up to 2000 packets per second, and as such are detected by the program in less than a second. So as I said, it shouldn't ever ban anyone not involved in DDoS attacks.
For those interested, I will probably push the source code to our Github account sometime soon.
If you do happen to notice any problems, please tell me.
Thanks in advance!
-- Ligustah
RE: DDoS protection - Storch - 14-01-2016
Actually I had some unusual problems in ND about an hour ago. I lagged out every few minutes for like 30 seconds, my ping jumped to 500, it said 'connection interrupted' and I literally couldn't do anything while others just kept on playing. Normally my connection is always steady so I guess my problems were due to this protecting thing and I thought I'd let you know.
RE: DDoS protection - Ligustah - 14-01-2016
This shouldn't make you lag. It will either ban you such that the servers become invisible to you, or not affect you at all. Please tell me if you problem persists, though.
RE: DDoS protection - Sky - 15-01-2016
Great news
So what you mean by ban is something that works like jaymod's IPban, meaning "banned" players will just see "Awaiting connection 1 ... 2 ... 3 ... 4 ... etc " indefinitely?
Or is it something else?
// Undirectly related
When I'm at my place using my internet, I can't seem to get /serverstatus working (only on ND ! ) 90% of the time, sometimes it works but often it doesn't, for no reason. It's it's only for TWC ND weirdly, other servers work just fine
When I'm at my dad's place there's no such problem though, do you have any idea? It's not that important I'm just curious
RE: DDoS protection - Kindral* - 15-01-2016
Good new, but i have lag if in ND have lot of peeps. All stuff are correct. Maybe its my connection but after it was fine
Sent from my HUAWEI SCL-L01 using Tapatalk
RE: DDoS protection - Ligustah - 15-01-2016
(15-01-2016, 12:02 AM)Sky Wrote: Great news
So what you mean by ban is something that works like jaymod's IPban, meaning "banned" players will just see "Awaiting connection 1 ... 2 ... 3 ... 4 ... etc " indefinitely?
Or is it something else?
It will actually use the firewall of the root server to filter any packets coming from the IP, which will render it unable to communicate with any of the game servers. It's like they are offline, so I guess it will show something like "Awaiting connection..".
Fun fact about this: it doesn't block communication in the other direction. So in the past, when we would use IP bans like these to ban annoying people or "hackers", they would still see everything written on the server. To them it was basically like they were lagging, but everyone else could still move. Once they timed out, they would often times message one of us on XFire and try to make fun of us, because to them it looked like they had just crashed our server
(15-01-2016, 12:02 AM)Sky Wrote: // Undirectly related
When I'm at my place using my internet, I can't seem to get /serverstatus working (only on ND ! ) 90% of the time, sometimes it works but often it doesn't, for no reason. It's it's only for TWC ND weirdly, other servers work just fine
When I'm at my dad's place there's no such problem though, do you have any idea? It's not that important I'm just curious
There are a lot of factors that might play into this, but if it's unrelated to the time of the day, it's most likely some QoS setting in the router that will prioritize other packets over the getstatus requests. Also et300 has some rudimentary DDoS protection, that will block getstatus requests at some point, so that might come into play there as well.
-- Ligustah
RE: DDoS protection - Ligustah - 16-01-2016
Small update:
The program has banned around 90 IP addresses so far and I haven't heard any complaints yet, so I'm assuming those were all legitimate bans.
For anyone interested, the source code is now available here: https://github.com/twcclan/getstatus-limiter (it's not actually that overwhelming :P)
-- Ligustah