SA-MP Forums

Go Back   SA-MP Forums > SA-MP Server > Server Support

Reply
 
Thread Tools Display Modes
Old 02/04/2019, 06:11 PM   #51
Whale
Little Clucker
 
Whale's Avatar
 
Join Date: Apr 2016
Posts: 19
Reputation: 5
Default Re: Servers are getting attacked

Quote:
Originally Posted by Mutemadiyen View Post
The IP list of the attackers in sa:mp servers is static. The attacker is adding sa:mp servers one by one. He hasn't updated his list for the last 2 weeks. So the IP address of the attackers in the sa: mp server list is two weeks ago. Server owners get rid of the attack by buying a new server(new ip). Because the attacker has long been not updating the IP list of sa: mp servers. You can also get rid of the attack by buying a new server.
or by Just ... Updating the Port?
Whale is offline   Reply With Quote
Old 02/04/2019, 07:44 PM   #52
Mellnik
Gangsta
 
Mellnik's Avatar
 
Join Date: Dec 2011
Location: Paradise Falls, CAℕADA
Posts: 767
Reputation: 373
Default Re: Servers are getting attacked

@Kalcor, have you considered this http://open-game-protocol.org/ ?
Mellnik is offline   Reply With Quote
Old 04/04/2019, 08:43 AM   #53
Markô
High-roller
 
Markô's Avatar
 
Join Date: Apr 2011
Location: dXJtb20=
Posts: 1,833
Reputation: 512
Default Re: Servers are getting attacked

The network lag continues, score takes minutes to update...is this going to be addressed or what ?
Markô is offline   Reply With Quote
Old 14/04/2019, 12:01 PM   #54
Michael@Belgium
High-roller
 
Michael@Belgium's Avatar
 
Join Date: Dec 2010
Location: Belgium
Posts: 1,768
Reputation: 1001
Default Re: Servers are getting attacked

Looks like the attacks stopped on the servers of my community. The ip's provided by Kye was a temporary fix + the range 186.0.0.0/8 - which was flooding too. Unblocked them all again

Quote:
Originally Posted by Kalcor View Post
If you don't need South American players, this should fend off most of the attack
Code:
/sbin/iptables -A INPUT -s 180.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -s 181.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -s 190.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -s 200.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -s 201.0.0.0/8 -j DROP
How to track queries in the server log? Add this to server.cfg
Code:
logqueries 1
You can monitor the server queries by tailing the server log
Code:
user@host:~/samp03$ tail -f server_log.txt | grep "query"
__________________

Need host-tab ? Contact me on discord^

sO aCtIvE
You last visited: 11/01/2018 at 11:21 PM
You last visited: 09/10/2018 at 08:30 PM
Michael@Belgium is offline   Reply With Quote
Old 14/04/2019, 06:16 PM   #55
Kalcor
SA-MP Developer
 
Join Date: Apr 2005
Posts: 1,180
Reputation: 2872
Post Re: Servers are getting attacked

I have uploaded a 0.3.7-R3 server

This version adds a variable queryflood which can be used to disable the query flood protection for 'i' and 'p' queries. This will stop the query mechanism shutting down which causes your server not to load in the list.

However, it's not a good idea to leave the flood protection disabled. Only do it when you're subjected to a query flood you know your server can handle.

Although it can be set in the server.cfg, I recommend logging in to the rcon in game. /rcon password then /rcon queryflood 0 to disable the query flood protection. Reenable the queryflood protection with /rcon queryflood 1 or by restarting your server. The option queryflood -1 will disable all query flood protection, even for rules and players packets.

Do not use option logqueries when under the current attack. Logging all queries under the current flood attack can hang the server.

SA-MP 0.3.7-R3 server (linux-i386)
SA-MP 0.3.7-R3 server (Windows)
Kalcor is offline   Reply With Quote
Old 14/04/2019, 06:49 PM   #56
Ubi
Little Clucker
 
Join Date: Sep 2011
Location: Poland
Posts: 36
Reputation: 19
Default Re: Servers are getting attacked

I wouldn't recommend setting it to -1 because bouncing "players" packets might generate huge outgoing traffic (reflected). Your provider (e.g. OVH) may block your server due to outgoing attack which we've experienced in the past.
__________________
Co-owner of the game server hosting: https://liveserver.pl/
Retired maintainer of the oldests Polish DM server: https://server-pps.com
Ubi is offline   Reply With Quote
Old 14/04/2019, 08:06 PM   #57
xo
Big Clucker
 
xo's Avatar
 
Join Date: Dec 2013
Location: I don't know.
Posts: 174
Reputation: 78
Default Re: Servers are getting attacked

@Ubi Have you given the OVH Game firewall a try? It works pretty decent filtering any kind of invalid queries per chosen server type (SA:MP exists in the list), though, sadly they are only existent on SYS/OVH Gaming dedicated servers
xo is offline   Reply With Quote
Old 14/04/2019, 08:51 PM   #58
D1eSeL
Big Clucker
 
D1eSeL's Avatar
 
Join Date: Oct 2013
Location: Ukraine, Kiev
Posts: 71
Reputation: 15
Default Re: Servers are getting attacked

Quote:
Originally Posted by Kalcor View Post
I have uploaded a 0.3.7-R3 server

This version adds a variable queryflood which can be used to disable the query flood protection for 'i' and 'p' queries. This will stop the query mechanism shutting down which causes your server not to load in the list.

However, it's not a good idea to leave the flood protection disabled. Only do it when you're subjected to a query flood you know your server can handle.

Although it can be set in the server.cfg, I recommend logging in to the rcon in game. /rcon password then /rcon queryflood 0 to disable the query flood protection. Reenable the queryflood protection with /rcon queryflood 1 or by restarting your server. The option queryflood -1 will disable all query flood protection, even for rules and players packets.

Do not use option logqueries when under the current attack. Logging all queries under the current flood attack can hang the server.

SA-MP 0.3.7-R3 server (linux-i386)
SA-MP 0.3.7-R3 server (Windows)
Server crashes after some time (linux)..

logqueries 0
__________________
REACT.SU - The Best AntiDDoS Solution
(Arizona Role Play, Radmir Role Play, Evolve Role Play, Samp Role Play, Trinity GTA, etc.)


__________________
DIESEL-COMMUNITY.COM - We give life to SA-MP projects


__________________
In the SA-MP community since 2006
D1eSeL is offline   Reply With Quote
Old 14/04/2019, 09:59 PM   #59
Ubi
Little Clucker
 
Join Date: Sep 2011
Location: Poland
Posts: 36
Reputation: 19
Default Re: Servers are getting attacked

Quote:
Originally Posted by xo View Post
@Ubi Have you given the OVH Game firewall a try? It works pretty decent filtering any kind of invalid queries per chosen server type (SA:MP exists in the list), though, sadly they are only existent on SYS/OVH Gaming dedicated servers
You didn't get my point. I'm talking about traffic reflection which might lead to server shutdown by OVH (or other provider) system due to high OUTGOING traffic (it has nothing to ovh game and any other input filtering). It seems that you are not familiar with this specific attack and UDP connectionless problems at all.
__________________
Co-owner of the game server hosting: https://liveserver.pl/
Retired maintainer of the oldests Polish DM server: https://server-pps.com
Ubi is offline   Reply With Quote
Old 14/04/2019, 10:15 PM   #60
Romz
Banned
 
Join Date: Jun 2013
Location: Ukraine
Posts: 1,042
Reputation: 64
Default Re: Servers are getting attacked

Quote:
Originally Posted by D1eSeL View Post
Server crashes after some time (linux)..

logqueries 0
I confirm I have the same problem.
Romz is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Getting attacked, any help? Sjn Server Support 5 30/03/2017 09:57 PM
Servers being attacked pls help me Arjanz Server Support 14 04/05/2014 08:48 AM
servers getting attacked !! cvnr0 Server Support 7 07/01/2014 02:51 PM
Bad RCON attempts - servers getting 'attacked' by the same IP Jstylezzz Server Support 18 15/05/2013 08:35 AM
Who attacked Doman Help Archive 0 28/03/2010 08:43 PM


All times are GMT. The time now is 07:09 AM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.