Re: fail2ban increase loadaverage to 18

[Adrian Minta <adrian.minta@gmail.com>]

Yes, it will, but you need to enable uRPF loose mode on the external 
interfaces ;)

!
interface GigabitEthernet1/1
 description External Provider 1
...
 ip verify unicast source reachable-via any
...
!
ip route XXX.XXX.XX.XXX 255.255.255.252.0 null0
!

If you have more than one router you could trigger this remotely via BGP:
http://packetlife.net/blog/2010/aug/23/source-based-rtbh/
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_urpf/configuration/12-4t/sec-data-urpf-12-4t-book.pdf



On 08/20/12 22:18, Leo Goehrs wrote:
> Forget about the nullrouting, it will not work in your case. The idea, is for example to set on your cisco a command like:
>
> Ip route XXX.XXX.XX.XXX 255.255.255.252.0 null0
>
> It will discard the return route, but will not eliminate the incoming flow.
>
> -----Original Message-----
> From: Michelle Konzack [mailto:linux4michelle@tamay-dogan.net]
> Sent: lundi 20 août 2012 21:15
> To: debian-isp@lists.debian.org
> Subject: Re: fail2ban increase loadaverage to 18
>
> Hello Henrique de Moraes Holschuh,
>
> Am 2012-08-19 22:01:09, hacktest Du folgendes herunter:
> > Null routing the source of the attacks will protect the servers from
> > *everything*, including customers in the null-routed networks.
> What is the config for "null routing"?
>
> Since there are only Servers in the network/netblock I do  not  think  I harm any normal users
>
> > It is of limited use on a DDoS because the attack source is all over
> > the map, but if all the crapflood comes from rackspace, null-routing
> > them will be very effective.
> Not all, but a bunch of IPs from there network.
>
> Thanks, Greetings and nice Day/Evening
>      Michelle Konzack
>
> --
> ##################### Debian GNU/Linux Consultant ######################
>     Development of Intranet and Embedded Systems with Debian GNU/Linux
>                 Internet Service Provider, Cloud Computing
>                  <http://www.itsystems.tamay-dogan.net/>
>                    <http://www.debian.tamay-dogan.net/>
>
> itsystems@tdnet                     Jabber  linux4michelle@jabber.ccc.de
> Owner Michelle Konzack
>
> Gewerbe Strasse 3                   Tel office: +49-176-86004575
> 77694 Kehl                          Tel mobil:  +49-177-9351947
> Germany                             Tel mobil:  +33-6-61925193  (France)
>
> USt-ID:  DE 278 049 239
>
> Linux-User #280138 with the Linux Counter, http://counter.li.org/


--
Best regards,
Adrian Minta    MA3173-RIPE, www.minta.ro