Stop DDOS attacks on a cisco router

[El-Farhatz]

ISPs have other options available that depend on routing changes, such as black hole filtering. Black hole filtering works by forwarding malicious traffic to an imaginary interface known as Null0 – similar to /dev/null on Unix machines. Since it’s not a valid interface, traffic routed to Null0 is essentially dropped. Moreover, this technique minimizes performance impact – a useful feature during the DDoS investigation so the rest of the network remains stable under the heavy load.
Here’s the simplest form of a black hole route:

Code:

Router(config)# int null0
Router(config-if)# no ip unreachable
Router(config)# ip route 1.1.1.1 255.255.255.0 null0

this statement sends all traffic arriving on this router to the null0 interface — in effect, discarding it and sending it to the black hole.
You could also redistribute this route into your dynamic routing protocol and have it sent to all other routers on your network. Then, all routers would send traffic to your router, and your router would drop that traffic.
Using ISP back hole you could limit some bad traffic, imagine that the target IP for the DDOS is 1.2.3.4 and my AS is 1234. The transit provider is 1000 and he blackhole community is tagged with 666.
On a cisco router I may use the following to blackhole the traffic before the
traffic enter my network.
router bgp 1234
bgp router-id 1.2.3.4
redistribute static route-map static-to-bgp
..
..
!
route-map static-to-bgp permit 5
match tag 666
set community 1000:666 additive
!


Regrads

El-Farhatz

[El-Farhatz]

wew sepi ,,, ,,, ntar ah pas gath aja dibahas

[wahyu_devilzc0de™]

ora sepi kok mas, mari kita ramamaiken.
mas, beda atau tidak, kalau router cisco kita diberi firewall untuk drop itu paket?, saya sih kyk gitu mas. :)

[anbu]

berat maen cisco...ilmunya belum sampe ane


ijin meratin aja kapan kapan harus belajar cisco

[El-Farhatz]

(08-12-2010 06:51 AM)wahyu_devilcode Wrote:  ora sepi kok mas, mari kita ramamaiken.
mas, beda atau tidak, kalau router cisco kita diberi firewall untuk drop itu paket?, saya sih kyk gitu mas. :)

bisa mas, firewall ada ips ada ids , nah dia intinya buka yg dizinkan tutup sisanya, trus dia jg kenali paket data aneh, msl nya koneksi yg establish atau fail.

tapi diingat firewall bukan segalanya ,

ada seperangkat server buat firewall , namanya watchguard , tapi dia bikin berat , karena data keluar dan masuk kudu melalui dia , dia menggunakan fungsi bridge , jadi bisa ga di detect sama orang yg ska usil , kalo ente trace dia, gadapet , besok ada filmnya tuh di rcti , firewall judulnye ,

server watchguard , digunakan departemen departemen biasanya , setahu ana , wallahua'lam

nah firewall yg di bridge susah kita deteknya, karen dia memfilter paket dgn manggle. tapi secara fisik susah kita serang , kita bisa kelabui dari dalam. nah itu soceng yg main.

---

(08-12-2010 07:59 AM)ade yonatan Wrote:  berat maen cisco...ilmunya belum sampe ane


ijin meratin aja kapan kapan harus belajar cisco

wah sama mas , ane juga baru belajar . yg penting kemauan sama semangat

[wahyu_devilzc0de™]

(08-12-2010 10:26 PM)El-Farhatz Wrote:  bisa mas, firewall ada ips ada ids , nah dia intinya buka yg dizinkan tutup sisanya, trus dia jg kenali paket data aneh, msl nya koneksi yg establish atau fail.

tapi diingat firewall bukan segalanya ,

ada seperangkat server buat firewall , namanya watchguard , tapi dia bikin berat , karena data keluar dan masuk kudu melalui dia , dia menggunakan fungsi bridge , jadi bisa ga di detect sama orang yg ska usil , kalo ente trace dia, gadapet , besok ada filmnya tuh di rcti , firewall judulnye ,

server watchguard , digunakan departemen departemen biasanya , setahu ana , wallahua'lam

nah firewall yg di bridge susah kita deteknya, karen dia memfilter paket dgn manggle. tapi secara fisik susah kita serang , kita bisa kelabui dari dalam. nah itu soceng yg main.

ok2 mas, ane maksud sekali. trus share ilmu cisconya mas bro, ane sangat perlu untuk menambah ilmu. :)

[El-Farhatz]

ane masih salut aja ama perangkat watchguard ini , mantep bener eui , lagi cari cara wat bypassnya , xixixi

soalnya dah perangkatnya mahal , manteb pulak , sama ssl thawte / verisign, itu yg biasa dipake di departemen , harganya ga nahan . bagi yg demen carding , kalo order web pake cc orang , disitus yg ada thawte nya , jarang yg dapet tracking order nya


hehe malahan nyambung ke ssl , buat mas wahyu , jgn lupa sering sering share dimari , ok bro ?....

[wahyu_devilzc0de™]

(08-12-2010 11:07 PM)El-Farhatz Wrote:  ane masih salut aja ama perangkat watchguard ini , mantep bener eui , lagi cari cara wat bypassnya , xixixi

sejauh ini watch guarder emang ampuh bener mas, ane juga masih jembol mas itu.

(08-12-2010 11:07 PM)El-Farhatz Wrote:  hehe malahan nyambung ke ssl , buat mas wahyu , jgn lupa sering sering share dimari , ok bro ?....

oke mas bro, dengan senang hati :)

[El-Farhatz]

watchguard emang top markotop . ane kemaren dah trial eroor coba bypas disalah satu server. tapi masih dalam tahap pengembangan.
iya watchguard fiturnya aja ada yg XTM, Multi Function Firewall, ama XCS , Content Security , ama ssl dan vpn dia jual

cek aja dimari : http://www.watchguard.com/products/
harganya aja selangit , heheh

[wahyu_devilzc0de™]

(08-12-2010 11:24 PM)El-Farhatz Wrote:  cek aja dimari : http://www.watchguard.com/products/
harganya aja selangit , heheh

ane sih, kalau masalah harga urusan si Bos, ane hanya buruh disitu. thanks mas bro.