Block a spoofing attack

V

vamos

Hello guys, I've get a problem with my server, someone attack my website (80 port) with spoofing IP like it:
Code: 
tcp4       0      0 localhost.80       124.243.9.149.40242    SYN_RCVD
tcp4       0      0 localhost.80       91.191.234.62.25615    SYN_RCVD
tcp4       0      0 localhost.80       95.141.204.48.23315    SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.251.1048    SYN_RCVD
tcp4       0      0 localhost.80       195.3.84.81.9228       SYN_RCVD
tcp4       0      0 localhost.80       189.10.148.150.40506   SYN_RCVD
tcp4       0      0 localhost.80       197.53.51.137.21266    SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.19.19982    SYN_RCVD
tcp4       0      0 localhost.80       28.99.179.43.16174     SYN_RCVD
tcp4       0      0 localhost.80       28.99.179.45.14082     SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.244.12097   SYN_RCVD
tcp4       0      0 localhost.80       64.46.85.75.35397      SYN_RCVD
tcp4       0      0 localhost.80       124.243.9.147.63280    SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.253.14408   SYN_RCVD
tcp4       0      0 localhost.80       142.230.54.219.53029   SYN_RCVD
tcp4       0      0 localhost.80       72.149.251.227.52532   SYN_RCVD
tcp4       0      0 localhost.80       124.243.9.145.11548    SYN_RCVD
tcp4       0      0 localhost.80       142.230.54.216.64000   SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.245.64576   SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.247.64540   SYN_RCVD
tcp4       0      0 localhost.80       26.238.171.220.33082   SYN_RCVD
tcp4       0      0 localhost.80       145.102.57.133.39727   SYN_RCVD
tcp4       0      0 localhost.80       145.102.57.132.38188   SYN_RCVD
tcp4       0      0 localhost.80       189.10.148.151.5899    SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.250.35609   SYN_RCVD
tcp4       0      0 localhost.80       95.141.204.52.34059    SYN_RCVD
tcp4       0      0 localhost.80       124.243.9.143.33813    SYN_RCVD
tcp4       0      0 localhost.80       145.102.57.138.20299   SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.24.12600    SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.25.10051    SYN_RCVD
tcp4       0      0 localhost.80       195.3.84.89.15949      SYN_RCVD
tcp4       0      0 localhost.80       95.141.204.46.546      SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.27.29509    SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.248.13340   SYN_RCVD
tcp4       0      0 localhost.80       142.230.54.215.12838   SYN_RCVD
tcp4       0      0 localhost.80       115.195.241.254.65054  SYN_RCVD
tcp4       0      0 localhost.80       145.102.57.139.51716   SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.26.46386    SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.254.63014   SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.22.42774    SYN_RCVD
tcp4       0      0 localhost.80       26.238.171.223.62500   SYN_RCVD
tcp4       0      0 localhost.80       88.48.51.61.8264       SYN_RCVD
tcp4       0      0 localhost.80       64.46.85.74.24073      SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.21.53795    SYN_RCVD
tcp4       0      0 localhost.80       124.243.9.144.19490    SYN_RCVD
tcp4       0      0 localhost.80       67.151.20.111.26927    SYN_RCVD
tcp4       0      0 localhost.80       184.228.186.75.9002    SYN_RCVD
tcp4       0      0 localhost.80       64.245.164.20.50448    SYN_RCVD
tcp4       0      0 localhost.80       124.243.9.148.22336    SYN_RCVD
tcp4       0      0 localhost.80       101.244.233.154.43027  SYN_RCVD
tcp4       0      0 localhost.80       142.230.54.207.37956   SYN_RCVD
tcp4       0      0 localhost.80       142.230.54.218.43311   SYN_RCVD
tcp4       0      0 localhost.80       145.102.57.134.47909   SYN_RCVD
tcp4       0      0 localhost.80       73.185.252.249.42769   SYN_RCVD
tcp4       0      0 localhost.80       124.243.9.146.24886    SYN_RCVD
Can ipfw block the spoofing or pf? Thanks in advance.
 
Any stateful firewall should be able to halt these "replies", since they will usually only allow a SYN in before creating a state. Without a state, other inbound traffic is rejected.
 
Since you have no control over your attacker you cannot stop him. You can however mitigate the effects of such an attack.

[thread=4108]Unofficial FreeBSD Security Checklist / Links / Resources[/thread]
 
pf can be setup to do block spoofed packets, see http://www.openbsd.org/faq/pf/filter.html#antispoof for examples.

Sorry, I don't use ipfw, so I can not help you with that.

You should follow the advice for SirDice at first, then get a firewall in place. Ok, in your case maybe the firewall first ;)
Any device being directly reachable from the internet must be properly secured and monitored.

I really like the IMHO excellent pf guide at calomel.org.
 
rohitewebtech said:
can u give me a few tips about stoping hacker attacking my pc ?
Click to expand...
To quote from a Harrison Ford movie "The course of action I'd suggest is the course of action i can't suggest"
Other than that, firewalls are the only way. Reading "Absolute FreeBSD" may also give some tipps how to make life better.
 
You must log in or register to reply here.
Back
Top