I'm being DDoS'd

[CombatW0mb4t]

So for the last few days, I've been having heavy packet drops on my fibre line,
After logging several calls with my ISP and them just doing the normal port reset etc, I decided to check my router to see what is going on.
Upon investigation I found this:



I'm getting bombed with 86k packets/second, I then torched the interface and I can see that I'm being hit by ICMP packets.


My question is aren't ISPs supposed to have some kind of DDoS protection in place to avoid attacks like this?

 

[netstrider]

Who is the ISP?

 

[S.Claus]

I’m willing to bet you play competitive games so install Cloudflare Warp and let them take care of the problem

 

[CombatW0mb4t]

ISP is Afrihost,

I've sent them all this info with no response, so there's that

 

[CombatW0mb4t]

I’m willing to bet you play competitive games so install Cloudflare Warp and let them take care of the problem

I do, but the thing is they are bombing my WAN interface, can't do squat with the interwebs while I'm being bombed.

 

[S.Claus]

I do, but the thing is they are bombing my WAN interface, can't do squat with the interwebs while I'm being bombed.

Ask for a IP change and make sure to use Warp (Warp+ if you can) when gaming. Unless there’s a leak you won’t be going offline

Their grabbing the IP in game so if you use Warp they will get the Cloudflare IP

@AfriNatic

 

[CombatW0mb4t]

Ask for a IP change and make sure to use Warp (Warp+ if you can) when gaming. Unless there’s a leak you won’t be going offline

Their grabbing the IP in game so if you use Warp they will get the Cloudflare IP

@AfriNatic

Thanks! I'll definitely check it out

 

[killerbyte]

Check what IPs you are being hit from and setup a drop rule.

 

[gregmcc]

Why do you have ICMP open?

 

[CombatW0mb4t]

Why do you have ICMP open?

I only noticed ICMP was open when I torched the interface and checked the rules, not sure if I put the rule there or if it's part of the default config,

But it's gone now.

I don't think its really going to make a difference, the 86 000 packets per sec will still hit the interface and consume my bandwidth

 

[vavyn]

So for the last few days, I've been having heavy packet drops on my fibre line,
After logging several calls with my ISP and them just doing the normal port reset etc, I decided to check my router to see what is going on.
Upon investigation I found this:

View attachment 1221936

I'm getting bombed with 86k packets/second, I then torched the interface and I can see that I'm being hit by ICMP packets.

View attachment 1221938
My question is aren't ISPs supposed to have some kind of DDoS protection in place to avoid attacks like this?

What software did you use?

 

[Peon]

ok, im also noticing timeouts on AH DNS requests. My ICMP is locked down. I hope that scourge from 2 yrs ago isint starting again.

 

[Sinbad]

Drop your connection and bring it up again, see if you get a new ip. If not, ask afrihost to change yours.

 

[cobusv]

i see you are using mikrotik, had the same issue and found it.

Click, IP, then DNS, and untick allow remote requests

 

[Rickster]

Send us the IP that is hitting you.

 

[CombatW0mb4t]

i see you are using mikrotik, had the same issue and found it.

Click, IP, then DNS, and untick allow remote requests
View attachment 1221998

Ah I see, I use the router to serve DNS requests to clients,

So I've just added rules to accept TCP/UDP 53 from LAN and drop anywhere else.

I'll check if that helps.

 

[CombatW0mb4t]

Send us the IP that is hitting you.

91.221.136.253 was the one that I documented,

But I got hit from an IPv6 source this morning.

 

[AfriNatic]

So for the last few days, I've been having heavy packet drops on my fibre line,
After logging several calls with my ISP and them just doing the normal port reset etc, I decided to check my router to see what is going on.
Upon investigation I found this:

View attachment 1221936

I'm getting bombed with 86k packets/second, I then torched the interface and I can see that I'm being hit by ICMP packets.

View attachment 1221938
My question is aren't ISPs supposed to have some kind of DDoS protection in place to avoid attacks like this?

Morning,

Which FNO are you using?

 

[CombatW0mb4t]

Morning,

Which FNO are you using?

Morning, I'm on Vuma.

 

[AfriNatic]

Morning, I'm on Vuma.

Please drop me a pm with your email address for me to investigate.