starred/LinuxGSM

Fork 0

mirror of https://github.com/GameServerManagers/LinuxGSM.git synced 2026-04-25 06:05:57 +03:00

[GH-ISSUE #473] GameServerQuery helps attacker get server offline. #393

New issue

Closed

opened 2026-02-27 02:01:13 +03:00 by kerem · 14 comments

kerem commented

2026-02-27 02:01:13 +03:00

Owner

Originally created by @iNilo on GitHub (Aug 26, 2015).
Original GitHub issue: https://github.com/GameServerManagers/LinuxGSM/issues/473

Originally assigned to: @UltimateByte on GitHub.

Hey, Im opening this issue to make you aware of an rather unfortunate issue.

I'm hosting some CSGO Servers and I'm sure it's purely accidental that this happened but when an attacker UDP floods the srcds ports (27015) the srcds will stop responding on those ports (out of self protection?).

So when running a cronjob every minute that checks for an offline server the 5 millisecond timeout is causing a restart.

https://github.com/dgibbs64/linuxgsm/blob/master/GameServerQuery/gsquery.py#L17

TLDR: attacker floods ports, query script thinks server is offline, attacker succeeds in taking down a (full) server.

This might be an unsolvable problem on your part and may require the server owners to protect against UDP floods, but I want to let you know this is happening

Originally created by @iNilo on GitHub (Aug 26, 2015). Original GitHub issue: https://github.com/GameServerManagers/LinuxGSM/issues/473 Originally assigned to: @UltimateByte on GitHub. Hey, Im opening this issue to make you aware of an rather unfortunate issue. I'm hosting some CSGO Servers and I'm sure it's purely accidental that this happened but when an attacker UDP floods the srcds ports (27015) the srcds will stop responding on those ports (out of self protection?). So when running a cronjob every minute that checks for an offline server the 5 millisecond timeout is causing a restart. https://github.com/dgibbs64/linuxgsm/blob/master/GameServerQuery/gsquery.py#L17 TLDR: attacker floods ports, query script thinks server is offline, attacker succeeds in taking down a (full) server. This might be an unsolvable problem on your part and may require the server owners to protect against UDP floods, but I want to let you know this is happening

kerem

2026-02-27 02:01:13 +03:00

closed this issue
added the
type: feature

info: docs
labels

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Aug 26, 2015):

Thanks for this info Will have to see if there is a way around this problem. Maybe there is some sort of whitelist for SRCDS or something. Will have to play around. However if anyone does find a way around this issue please post it.

@dgibbs64 commented on GitHub (Aug 26, 2015): Thanks for this info Will have to see if there is a way around this problem. Maybe there is some sort of whitelist for SRCDS or something. Will have to play around. However if anyone does find a way around this issue please post it.

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@iNilo commented on GitHub (Aug 26, 2015):

My first idea is to RCON query the server since that is TCP and afaik the RCON was still available when under attack.

But that's just an entire different way then the current implementation

@iNilo commented on GitHub (Aug 26, 2015): My first idea is to RCON query the server since that is TCP and afaik the RCON was still available when under attack. But that's just an entire different way then the current implementation

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Aug 26, 2015):

That may be possible. Will take a while to implement something though

@dgibbs64 commented on GitHub (Aug 26, 2015): That may be possible. Will take a while to implement something though

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@ghost commented on GitHub (Aug 26, 2015):

Hi,

this can be solved with the following iptables rule:

-A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name DEFAULT --rsource -j DROP

basically this rule will drop anyone who send more than 10 requests in less than 60 seconds. those numbers are not mandatory and you can adapt for your needs.

@ghost commented on GitHub (Aug 26, 2015): Hi, this can be solved with the following iptables rule: -A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --set --name DEFAULT --rsource -A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name DEFAULT --rsource -j DROP basically this rule will drop anyone who send more than 10 requests in less than 60 seconds. those numbers are not mandatory and you can adapt for your needs.

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Aug 26, 2015):

Thats a really useful bit of info

@dgibbs64 commented on GitHub (Aug 26, 2015): Thats a really useful bit of info

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@iNilo commented on GitHub (Aug 26, 2015):

Yea, not just useful its awesome. just reminds me how powerful iptables are and should really try and understand the iptables chains

@iNilo commented on GitHub (Aug 26, 2015): Yea, not just useful its awesome. just reminds me how powerful iptables are and should really try and understand the iptables chains

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@digimon-dk commented on GitHub (Mar 21, 2016):

I'm new to iptables . is it right to do it like this in ubuntu ??
command:
sudo iptables -A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name DEFAULT --rsource -j DROP

Thanks for a awesome work 👍

@digimon-dk commented on GitHub (Mar 21, 2016): I'm new to iptables . is it right to do it like this in ubuntu ?? command: sudo iptables -A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --set --name DEFAULT --rsource -A INPUT -p udp -m udp --dport 27015 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name DEFAULT --rsource -j DROP Thanks for a awesome work :+1:

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Mar 21, 2016):

The UFW is probably a better option and simpler for Ubuntu. My understanding is that is uses iptables but makes it simple to use

https://wiki.ubuntu.com/UncomplicatedFirewall

Here is a tutorial that may help
https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-with-ufw-on-ubuntu-14-04

@dgibbs64 commented on GitHub (Mar 21, 2016): The UFW is probably a better option and simpler for Ubuntu. My understanding is that is uses iptables but makes it simple to use https://wiki.ubuntu.com/UncomplicatedFirewall Here is a tutorial that may help https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-with-ufw-on-ubuntu-14-04

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@AlexCS1337 commented on GitHub (Mar 22, 2016):

Nice info on the iptables etc, I think I had similar problem on my Gmod server haha

@AlexCS1337 commented on GitHub (Mar 22, 2016): Nice info on the iptables etc, I think I had similar problem on my Gmod server haha

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@dgibbs64 commented on GitHub (Jul 12, 2016):

This could do with updating on the WIKI. I require a knowledgeable person to create a brief page about firewalls for Ubuntu and CentOS and how to protect your query port

@dgibbs64 commented on GitHub (Jul 12, 2016): This could do with updating on the WIKI. I require a knowledgeable person to create a brief page about firewalls for Ubuntu and CentOS and how to protect your query port

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@UltimateByte commented on GitHub (Aug 27, 2016):

Will do it.

@UltimateByte commented on GitHub (Aug 27, 2016): Will do it.

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@UltimateByte commented on GitHub (Aug 28, 2016):

Is this enough for now ?
https://github.com/GameServerManagers/LinuxGSM/wiki/Firewalls

@UltimateByte commented on GitHub (Aug 28, 2016): Is this enough for now ? https://github.com/GameServerManagers/LinuxGSM/wiki/Firewalls

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@UltimateByte commented on GitHub (Oct 18, 2016):

Well, i guess it's enough. :)

@UltimateByte commented on GitHub (Oct 18, 2016): Well, i guess it's enough. :)

kerem commented

2026-02-27 02:01:14 +03:00

Author

Owner

@lock[bot] commented on GitHub (Jul 19, 2018):

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@lock[bot] commented on GitHub (Jul 19, 2018): This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

kerem referenced this issue

2026-02-27 03:53:16 +03:00

[PR #393] [MERGED] Master #3092

kerem referenced this issue

2026-02-27 03:53:16 +03:00

[PR #405] [MERGED] Ts3server installer #3095