3 ms·
DoS Attack Against Mastodon.online and Mastodon.social
- LinuxBender 4y agoEasy enough temporary work-around for such a simple DoS. Grab their CIDR blocks [1] put into a text file, then in a "for loop" as root do: ip route add blackhole ${Ip} 2>/dev/null Repeat with any VPS providers they jump to, excluding your own IP and gateway addresses of course. It's safest to do this from a remote console window vs ssh just in case you block yourself. Once one is confident this is doing the needful, put it in a systemd unit file. Also look at the characteristics of their SYN traffic to see if they are missing things like MSS, SackOK, etc... such things can be blocked in iptables using mss and length modules. tcpdump -p -i any -NNnnt -c512 -s0 proto 6 and 'tcp[13] == 2]' and host {one of their IP's} There are a myriad of other things that can reduce the impact but try just blackhole DO networks first. Longer term the application code should be fixed so it can handle infinite requests per second and just deal with it even if that means giving an in-memory static page and "Connection: close" for IP's that make too many requests per second so that xt_recent iptables module can be used. [1] - https://bgp.he.net/AS14061#_prefixes https://bgp.he.net/AS14061#_prefixes