Announcements and discussions regarding Huwhyte KF2 HoE+ and CD servers

Once in a while, like in a couple of days, a new DDoS (or DoS?) comes by.

It's the same thing that relies on the game port disproportionately large responses, but it probably comes from a different actor and relies on different software.

So far the differences are:

* there's no variation in source port at least across a good share of consecutive requests;
* have normal TTL, so Noodle's TTL trick no longer helps;
* instead of timing out, seems to close connections gracefully, which is quite preposterous.

Two examples of how it looks like in the logs:

https://steamproxy.net/sharedfiles/filedetails/?id=3465113257

https://steamproxy.net/sharedfiles/filedetails/?id=3465113518

Hilariously, the TWI's official anti-DDoS defense doesn't seem to work. But here I don't blame them as much, as this new thing is with a new twist, so they may just have not prepared for this.

Similarly, my own fail2ban script also doesn't pick it up and needs some adjustments.

The only thing that still works is baz's rate limiting script. Here below you can see the rate with which the script drops excessive connections:

https://steamproxy.net/sharedfiles/filedetails/?id=3465113732

As you can see, the rate limiting firewall rule dropped here just 49 packets of 9883857-9879151=4706 bytes in 53 seconds, which is quite mild, but still can cause the KF2 servers to lag, if allowed in on an undefended KF2 server. Thanks baz, it's not allowed and the server is defended.

Also note, that TTL dropping rules don't get much on their counters, just some random bots the internet is full of that likely have nothing to do with this DDoS.

Another peculiarity is this happens rarely so far, lasts for just a few hours and happens like once in several days and then goes silent for a long time.

Also, the servers being attacked here are on higher range ports. The previous DDoS software mostly didn't work if one was running KF2 servers on higher ports, so this advice to change the ports to higher numbers, overall, probably contributed the most to that DDoS demise. The TTL trick while was 100% effective required Linux, which only a minority of hosters use, as well as admin rights on it, which hosters like gameservers.com don't allow. So most hosters (who didn't simply shut down their servers and left the game) just jumped on higher ports per mine and others advice stemming from this finding:

https://steamproxy.net/groups/Huwhyte/announcements/detail/3781395613865713805.html

and it worked for them, I guess.

Just to make sure, it has nothing to do with any in-game cheating or exploits, it also has nothing to do with the admin web console crash DoS, likely used by Tamari in the past to crash remotely mine and fanta's servers (at least).

It's already the 3rd or 4th time this happens, next time it's gonna cross the threshold of being annoying enough for me to alter the fail2ban script to further reduce damage, so at least it doesn't amplify anything outside of a very short period needed to accumulate enough stats on IP addresses and doesn't crap into the logs.