DDoS Protection

Setting up a GRE VPN between two servers.

In this guide I will try to explain how one can get an affordable and fast DDoS protection by simply knowing some Linux commands. The protection is based around a principle of using a GRE (VPN) tunnel to proxy all of the data from your main server where the game is hosted, to a VPS that has some DDoS protection. The protection on that VPS will handle all of the DDoS, leaving your main server safe and sound behind the barrier, as well as masking your server's real IP.

You still need to be careful with who you trust, since applications or scripts you put on your server have the ability to disclose the real IP of your server!

Prerequisites

• A Linux server where the game will be hosted
• A Linux VPS that will proxy your traffic
• (preferable) Debian 9 Stretch or newer on both machines

Configuration on both machines

Required packages

For this, you'll need the following apt packages:

iptables
ip_gre

Making sure your kernel modules are loaded

You need to make sure you have the following kernel modules available to use:

ip_gre
ip_tunnel
ip_tables
gre

You can do this by running:

lsmod | grep ip_

and looking at the output. If these modules aren't loaded, you can load them by running:

modprobe ip_gre

Making sure you can forward IPv4

Check the output of

sysctl net.ipv4.ip_forward

if it's set to 0, make sure it's set to 1

sysctl -w net.ipv4.ip_forward=1

Configuration on the host

Create the GRE tunnel

First, you need to add a new GRE tunnel, you can do that by running

ip tunnel add gre1 mode gre remote PROXY_EXTERNAL_IP local HOST_EXTERNAL_IP ttl 255

Make sure to replace PROXY_EXTERNAL_IP and HOST_EXTERNAL_IP with your IPs.

You can also use a name other than gre1, but for the sake of this document we'll assume the tunnel is named gre1 on both machines.

Then, you need to make sure your new tunnel is up

ip link set gre1 up

And finally, add the IP address you wish to use. I usually use the 10.10.10.0/24 range for my use cases.

ip addr add 10.10.10.1/24 dev gre1

You can, of course, change 10.10.10.1 to anything else if you want your host's internal IP to be different.

Add the interface to the route table

You'll need to add the interface to the routes table, to do that use a text editor or just run the following command

echo '100 GRE1' >> /etc/iproute2/rt_tables

Then you need to set up the rules for the IP, as well as default route

ip rule add from 10.10.10.0/24 table GRE1
ip route add default via 10.10.10.2 table GRE1

Make sure to change 10.10.10.2 to your proxy's internal IP, as will be configured later in this document.

iptables

You may need to let iptables know that you want all connections from 10.10.10.0/24 subnet to be accepted. It will allow any connections by default, so do that only if you changed anything.

Configuration on the proxy

It's mostly the same deal as on the host, but reversed a bit.

Create the GRE tunnel

You know the drill by now:

ip tunnel add gre1 mode gre remote HOST_EXTERNAL_IP local PROXY_EXTERNAL_IP ttl 255

Notice that HOST_EXTERNAL_IP and PROXY_EXTERNAL_IP have changed places in this command. Beware!

Similarly, you need to set up the interface first:

ip link set gre1 up

and give it an IP

ip addr add 10.10.10.2/24 dev gre1

you can replace 10.10.10.2 with any desired local IP.

Set up NAT forwarding

iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -j SNAT --to-source PROXY_EXTERNAL_IP

Set up port forwarding from proxy to host

Finally, once everything is set up, in order to forward a port you simply need to run the following iptables commands:

# You can, of course, change the port to anything you desire.
# Change the protocol/port (tcp/12345) to anything you need. You need to do this for every port.
iptables -t nat -A PREROUTING -p tcp -d PROXY_EXTERNAL_IP --dport 12345 -j DNAT --to-destination 10.10.10.1:12345
iptables -A FORWARD -p tcp -d 10.10.10.1 --dport 12345 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Saving iptables configuration

Make sure you have iptables-persistent in order for your IP forwarding configuration to persist between machine restarts. Run iptables-save every time you add a new port.

And you're done!

I hope this little tutorial was useful enough to you!