# Update on DoS Attacks against our Online Game

DevFeed: [Update on DoS Attacks against our Online Game](<https://devfeed.tech/articles/update-on-dos-attacks-against-our-online-game-30814.md>)

Original publisher: [Read original article](<https://hookrace.net/blog/dos-attacks-update/>)

Published: 2022-05-15T22:00:00Z

Content type: article

Language: en

Sources: [Dennis Felsing](<https://devfeed.tech/sources/dennis-felsing.md>)

Topics: [spoofing](<https://devfeed.tech/topics/spoofing.md>), [servers](<https://devfeed.tech/topics/servers.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [client](<https://devfeed.tech/topics/client.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [https](<https://devfeed.tech/tags/https.md>), [ipv4](<https://devfeed.tech/tags/ipv4.md>), [ipv6](<https://devfeed.tech/tags/ipv6.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [server](<https://devfeed.tech/tags/server.md>), [servers](<https://devfeed.tech/tags/servers.md>), [spoofing](<https://devfeed.tech/tags/spoofing.md>), [udp](<https://devfeed.tech/tags/udp.md>)

## AI overview

This update describes ongoing DoS attacks against the open-source DDraceNetwork online game. It explains how spoofed UDP connection attempts overload single-threaded game servers and outlines an HTTPS-based IP whitelist, along with limitations involving capacity, IPv4, IPv6, and ISP address translation.

## Source excerpt

In my previous post 8 months ago I described how our open source online game DDraceNetwork has been suffering under DoS attacks for about 8 years, basically since its inception. Recently the attacks have gotten much worse, forcing us to work on further approaches. Since many players made suggestions recently, I'm writing this blog post to summarize what we are attempting and to ask for help again. These traffic graphs are from two of the servers we are running, note the logarithmic x-axis. Each spike represents an incoming DoS attack, as you can see some of them last for nearly a day. Recently the attacks have been relatively weak in terms of incoming bandwidth, using spoofed IP addresses imitating our UDP-based connection process. At first the CPU gets overloaded since the server suddenly has to try and handle hundreds of thousands of connection attempts per second. Since our game servers are mostly running on cheap VPSes and each game server runs single-threaded, it is quite easy to overload a system in this manner. HTTPS-based Whitelist To prevent spoofing we collect all players' IP addresses and whitelist those. Since we also develop the game client, we can modify the client to connect to a server via HTTPs for this whitelisting. The iptables rules and ipset setup on the game servers for this whitelist look something like this: ipset create official iphash ipset create whitelist-ip iphash iptables -N serverinfo iptables -A serverinfo -m hashlimit --hashlimit-above 40/s --hashlimit-mode dstport --hashlimit-name si_dstport -j DROP iptables -N game iptables -A game -m set --match-set official src -j ACCEPT iptables -A game -m set --match-set whitelist-ip src -m u32 --u32 "38=0x67696533" -j serverinfo iptables -A game -m set --match-set whitelist-ip src -m u32 --u32 "38=0x66737464" -j serverinfo iptables -A game -m set --match-set whitelist-ip src -j ACCEPT # Still allow non-whitelisted players when there is no attack iptables -A game -m limit --limit 10000 -j ACCEP