I'll try and explain more thoroughly the problem and why this is important since a lot of people seemed confused by these comments.
Many server owners have been faced with DDoS/DoS attacks at some point, either from cheaters who have been banned or from admin situations which could have been handled more professionally, etc. Large DDoS attacks will result in a null-route which could last several days depending on how large the attack was. The problem: keeping your server playable in the mean time. One solution might be to close down the game server and re-launch it on another IP address but this requires constant monitoring and players are confused. The better solution is to integrate DNS so players will join a server by an A-record linked to their srcds instance. This feature is currently not available. In the mean time, it's possible to use iptables mangling and existing DNS to keep the server online. This process involves 2 IP addresses and a DNS record. One IP will be your srcds IP the other IP will be a non-srcds IP that you have available. The DNS will link to your non-srcds IP. iptables comes in and internally forwards packets to the srcds IP which were sent to the non-srcds IP. The result of this configuration is that even when your main IP is null routed, your players can still join via the DNS name (connecting to the non-srcds IP) which will let them join the srcds server without any hands on reconfiguration needed. Example: .100 is my game server. .101 does not have any game server on it and, to the best of my knowledge, does not appear in the master browser list. iptables -L -t nat -n Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT udp -- 0.0.0.0/0 75.102.27.101 udp dpt:27015 to:75.102.27.100:27015 Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination This configuration should *not* create another server listing on the master browser list. Could Valve confirm that the .101 IP does not appear on the master browser list? If it does, I will change my rules around... my point was that there are legitimate iptables mangling rules and there are also more devious rules involving faking multiple server instances. Faking multiple service instances is a problem and I'm glad it's getting some attention, but I'll be happier when DNS is integrated with the master browser list. On Sun, Dec 11, 2011 at 3:00 PM, <[email protected]>wrote: > Send hlds_linux mailing list submissions to > [email protected] > > To subscribe or unsubscribe via the World Wide Web, visit > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > or, via email, send a message with subject or body 'help' to > [email protected] > > You can reach the person managing the list at > [email protected] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of hlds_linux digest..." > > > Today's Topics: > > 1. Re: iptables mangling (Vintage Jailbreak) > 2. Re: iptables mangling (Jesse Molina) > 3. Re: iptables mangling (Steven Linn) > 4. Re: Server locking up with 100% cpu usage (Mike Johansen) > 5. Re: Server locking up with 100% cpu usage (Mike Johansen) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 10 Dec 2011 22:58:07 -0500 > From: Vintage Jailbreak <[email protected]> > To: [email protected] > Subject: Re: [hlds_linux] iptables mangling > Message-ID: > <CAPs+1ghJmgm3YBSMw1Lref_1q3=_cp-qpaeojalsxfbhfpn...@mail.gmail.com > > > Content-Type: text/plain; charset=ISO-8859-1 > > It's important to point out that there are iptables mangling configurations > that won't produce a second server on the master browser list. One valid > use of these rules is to have a secondary IP address that your server is > accessible on in case the primary IP is taken out by a DDoS attack. > Valve's switch to DNS based server addresses would obviate the need for > such mangling. Could someone verify IP 75.102.27.101 does *not* appear on > the master browser list? If it does, could Valve look into getting DNS > support before they cut off these servers? > > > ------------------------------ > > Message: 2 > Date: Sat, 10 Dec 2011 22:12:29 -0700 > From: Jesse Molina <[email protected]> > To: Half-Life dedicated Linux server mailing list > <[email protected]> > Subject: Re: [hlds_linux] iptables mangling > Message-ID: <[email protected]> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > What you are doing is crazy. Stop doing it. > > No offense intended. I am sure that you are just deeply deeply confused. > > > > Vintage Jailbreak wrote: > > It's important to point out that there are iptables mangling > configurations > > that won't produce a second server on the master browser list. One valid > > use of these rules is to have a secondary IP address that your server is > > accessible on in case the primary IP is taken out by a DDoS attack. > > Valve's switch to DNS based server addresses would obviate the need for > > such mangling. Could someone verify IP 75.102.27.101 does *not* appear > on > > the master browser list? If it does, could Valve look into getting DNS > > support before they cut off these servers? > > _______________________________________________ > > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > -- > # Jesse Molina > # Mail = [email protected] > # Page = [email protected] > # Cell = 1.602.323.7608 > # Web = http://www.opendreams.net/jesse/ > > > > > > ------------------------------ > > Message: 3 > Date: Sun, 11 Dec 2011 04:27:03 -0500 > From: Steven Linn <[email protected]> > To: Half-Life dedicated Linux server mailing list > <[email protected]> > Subject: Re: [hlds_linux] iptables mangling > Message-ID: > <cacwo3p5ypym0fxa0jhfwkru3ne_opg6kg_2erdcseriodyz...@mail.gmail.com > > > Content-Type: text/plain; charset=ISO-8859-1 > > I have no idea what he is trying to say. But it seems like hes talking > about not being able to access a master server. > On Dec 11, 2011 12:12 AM, "Jesse Molina" <[email protected]> wrote: > > > > > What you are doing is crazy. Stop doing it. > > > > No offense intended. I am sure that you are just deeply deeply confused. > > > > > > > > Vintage Jailbreak wrote: > > > >> It's important to point out that there are iptables mangling > >> configurations > >> that won't produce a second server on the master browser list. One > valid > >> use of these rules is to have a secondary IP address that your server is > >> accessible on in case the primary IP is taken out by a DDoS attack. > >> Valve's switch to DNS based server addresses would obviate the need for > >> such mangling. Could someone verify IP 75.102.27.101 does *not* appear > on > >> the master browser list? If it does, could Valve look into getting DNS > >> support before they cut off these servers? > >> ______________________________**_________________ > >> To unsubscribe, edit your list preferences, or view the list archives, > >> please visit: > >> https://list.valvesoftware.**com/cgi-bin/mailman/listinfo/**hlds_linux< > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux> > >> > > > > -- > > # Jesse Molina > > # Mail = [email protected] > > # Page = [email protected] > > # Cell = 1.602.323.7608 > > # Web = http://www.opendreams.net/**jesse/< > http://www.opendreams.net/jesse/> > > > > > > > > ______________________________**_________________ > > To unsubscribe, edit your list preferences, or view the list archives, > > please visit: > > https://list.valvesoftware.**com/cgi-bin/mailman/listinfo/**hlds_linux< > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux> > > > > > ------------------------------ > > Message: 4 > Date: Sun, 11 Dec 2011 12:07:05 +0100 > From: Mike Johansen <[email protected]> > To: "'Half-Life dedicated Linux server mailing list'" > <[email protected]> > Subject: Re: [hlds_linux] Server locking up with 100% cpu usage > Message-ID: <[email protected]> > Content-Type: text/plain; charset="us-ascii" > > By killing it I mean: > > function stop_server { > if [[ `screen -ls | grep $SCREENNAME` ]]; then > echo -n "Stoppe $SCREENNAME" > kill `screen -ls | grep $SCREENNAME | awk -F . '{print $1}'| awk '{print > $1}'` > echo " ... done." > else > echo "Konnte den Screentab $SCREENNAME nicht finden" > fi > } > > This is not my script, I got it from another site. And the host does not go > down, I never said that, it locks up. It's online, and the hardware has > been > tested yesterday by the DC and they can report that the hardware is as > stable as can be. The only thing the logs show is the usual stuff, it does > not report anything useful in terms of the srcds locking up. > > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Jesse > Molina > Sent: 10. desember 2011 23:50 > To: Half-Life dedicated Linux server mailing list > Subject: Re: [hlds_linux] Server locking up with 100% cpu usage > > > Mike Johansen wrote: > > The script is not the problem. > > Sometimes it starts the server without any > > error, and no, it kills it> update> start. > > How are you "killing" it, and what are you killing? Be explicit. There > are > a number of ways to screw up here. > > > > > The logs does not show anything useful either, no errors in anything, > just > a > > black console screen in the server. > > > > How do you know that the CPU is going to 100% is you lose all access to > the host and "logs does not show anything useful"? sar? SNMP? > > The fact that your entire host goes down seems to indicate a much more > significant problem, like hardware instability. Are you running your > process in realtime, high prio, or what? This just does not happen. > Magic does not exist. > > There is much that is relevant which you have not told us. > > > > -- > # Jesse Molina > # Mail = [email protected] > # Page = [email protected] > # Cell = 1.602.323.7608 > # Web = http://www.opendreams.net/jesse/ > > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > > > > ------------------------------ > > Message: 5 > Date: Sun, 11 Dec 2011 12:34:37 +0100 > From: Mike Johansen <[email protected]> > To: "'Half-Life dedicated Linux server mailing list'" > <[email protected]> > Subject: Re: [hlds_linux] Server locking up with 100% cpu usage > Message-ID: <[email protected]> > Content-Type: text/plain; charset="us-ascii" > > Only thing that could be something: > Dec 11 05:15:01 server56258 /USR/SBIN/CRON[3083]: (srcds) CMD (cd > /home/srcds && ./start1.sh update >/dev/null 2>&1) > Dec 11 05:15:09 server56258 /USR/SBIN/CRON[3071]: (CRON) error (grandchild > #3081 failed with exit status 1) > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Mike > Johansen > Sent: 11. desember 2011 12:07 > To: 'Half-Life dedicated Linux server mailing list' > Subject: Re: [hlds_linux] Server locking up with 100% cpu usage > > By killing it I mean: > > function stop_server { > if [[ `screen -ls | grep $SCREENNAME` ]]; then echo -n "Stoppe > $SCREENNAME" > kill `screen -ls | grep $SCREENNAME | awk -F . '{print $1}'| awk '{print > $1}'` echo " ... done." > else > echo "Konnte den Screentab $SCREENNAME nicht finden" > fi > } > > This is not my script, I got it from another site. And the host does not go > down, I never said that, it locks up. It's online, and the hardware has > been > tested yesterday by the DC and they can report that the hardware is as > stable as can be. The only thing the logs show is the usual stuff, it does > not report anything useful in terms of the srcds locking up. > > > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Jesse > Molina > Sent: 10. desember 2011 23:50 > To: Half-Life dedicated Linux server mailing list > Subject: Re: [hlds_linux] Server locking up with 100% cpu usage > > > Mike Johansen wrote: > > The script is not the problem. > > Sometimes it starts the server without any > > error, and no, it kills it> update> start. > > How are you "killing" it, and what are you killing? Be explicit. There > are > a number of ways to screw up here. > > > > > The logs does not show anything useful either, no errors in anything, > > just > a > > black console screen in the server. > > > > How do you know that the CPU is going to 100% is you lose all access to the > host and "logs does not show anything useful"? sar? SNMP? > > The fact that your entire host goes down seems to indicate a much more > significant problem, like hardware instability. Are you running your > process in realtime, high prio, or what? This just does not happen. > Magic does not exist. > > There is much that is relevant which you have not told us. > > > > -- > # Jesse Molina > # Mail = [email protected] > # Page = [email protected] > # Cell = 1.602.323.7608 > # Web = http://www.opendreams.net/jesse/ > > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > > > > ------------------------------ > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > > > End of hlds_linux Digest, Vol 46, Issue 28 > ****************************************** > _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
