View Single Post
Author Message
spumer
Senior Member
Join Date: Aug 2011
Old 05-09-2017 , 03:54   [Linux] Source Query Proxy: DDoS Protection - Kernel redirection!
Reply With Quote #1

Source Query Proxy

Motivation

Basically Source game-servers works in one thread and can't use more than one core for in-game logic. For example - Left 4 Dead 2.
Yes, you can use SourceMod to offload calculations (use threading), but we talking about common game logic.

You can try use DoS Protection extension, but caching is not fast solution, cause server spent time to receiving and sending answer from cache.

So, we just need redirect some packets to proxy service

IPTables (or any NAT) can't help!


If you use IPTables (NAT) to redirect queries to proxy, this rule will be remembered in routing table and if client try to connect - connection will be redirected to proxy too.


Linux Kernel filter

It works!
Just register packet handler and move on top (set specific priority), at this moment packet placed in RAW routing table and no one rule applied before. Now we change destination port, calculate new checksum and let him go further! In next step packet will be matched and redirected according to the NAT rules and go to our Proxy service. Answers from service will be translated by same logic.
For example incoming:
27015 -> 27915
27016 -> 27916
...
and outgoing handler change port back:
27915 -> 27015
27916 -> 27016
...



Solution


Python cache backend: https://github.com/sqproxy/sqproxy
Kernel redirection to that backend: https://github.com/sqproxy/sqredirect

Troubleshooting
See the issues on github. Problem or solution can be presented before

Follow new releases on github
__________________

Last edited by spumer; 06-22-2021 at 08:18.
spumer is offline