Delimiter DDoS / Shutting Down Server

netomx

@mikeyur said:
I was chatting with MarkTurner about a way to effectively whitelist folks, especially in a multi-user situation. His suggestion was have a webpage up that people need to login to which automatically updates the ACL to allow that /32. Rather than doing IP ranges at the country/ASN level, you just need to visit server.com/plex and punch in a user/pass to unblock the /32 you're on.

sounds great, but what if you change the Plex port? Isn't it be easy

@ManofServer said:
Time to buy up that Netflix subscription you've been evading!

Netflix + Plex + Mexican Roku = GG

mike0000

@netomx said:
sounds great, but what if you change the Plex port? Isn't it be easy

Yeah, changing it away from the default port would help

netomx

@mikeyur said:
Yeah, changing it away from the default port would help

Plex server isn't coded to change the port. Maybe block outgoing connection from 32400, and adding an iptables rule to forward X port to 32400 ?

johoja

Plex doesn't let you change the port - i tried iptables to see if i could get port re-directed but was not able to get it to work unfortunately

marcosa

@johoja I can manual map the port on Windows, and there is the same feature for Linux. According to this article, it's possible locations if you're dealing with different distros.
https://support.plex.tv/hc/en-us/articles/201105343-Advanced-Server-Settings

netomx

@johoja said:
Plex doesn't let you change the port - i tried iptables to see if i could get port re-directed but was not able to get it to work unfortunately

It works, I used that on my home network:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport OTHERPORT -j REDIRECT --to-port 32400

johoja

@marcosa - are you sure thats not the external port mapping ? from what i've seen you can change the external port that is advertised to myplex/plex.tv but the internal port stays at 32400.

@netomx - i tried the command you suggested but it did not work for me for some reason...not sure why.

marcosa

@johoja

Do you have problems with your internal network in regards of port scan or attacks? It would be just fine if you map to another external port and keep your internal network secure. Other than that, you can try iptables port forwarding approach, which is essentially the same.

https://forums.plex.tv/discussion/197697/help-alterating-remote-access-port

seaeagle

i have a teamspeak server running on a delimiter dedi and about once every 3-8 weeks we get dropped for 5mins - server is still up, esx is still up, windows is still up.... ive never bothered looking into it but have always assumed it was a DDOS that caused all connections to drop....

MarkTurner

seaeagle said: ive never bothered looking into it but have always assumed it was a DDOS that caused all connections to drop....

If you PM me your IP, I'll confirm

johoja

@netomx - tried it again and that iptables rule you gave seems to work - not sure why it didn't before.

Edit: spoke to soon if i remove my iptable allow rules for 32400 - the redir does not work - as it hits the 32400

Edit2: figured it out - if i allow 32400 in the input table - i need a prerouting rule in the nat table for 32400 that redirects it to a closed port - after that - the original redirect works.

O8ama

Just buy a new server form you. But I find unable to reinstall debian jessie via Provisioin @MarkTurner
I PMed ticket number

mike0000

@O8ama said:
Just buy a new server form you. But I find unable to reinstall debian jessie via Provisioin MarkTurner
I PMed ticket number

You'll have to wait for someone in support to get back to you.

But I'm going to take a stab in the dark and say that you're trying to login as root@SERVER - which has password auth disabled for it by default in Jessie. You need to create another user in the fields provided in provisioning and login via that, then su your way into root.

LogicX

More thoughts on obfuscating plex, for fun:

1: proxy through apache with this guide

Note that you must enable modules:

cd /etc/apache2/mods-enabled

ln -s ../mods-available/headers.load

ln -s ../mods-available/proxy_wstunnel.load

ln -s ../mods-available/rewrite.load

ln -s ../mods-available/proxy_connect.load

ln -s ../mods-available/proxy_http.load

ln -s ../mods-available/proxy_html.load

ln -s ../mods-available/proxy.load

2: Following this guide
I preferred these modifications: (-I instead of -A put it at the top of the CHAINS, making it work if you're also using peerguardian)

You can also add these to /etc/rc.local:

iptables -t nat -I PREROUTING -p tcp -m tcp -d YOUR_PUBLIC_IP_HERE --dport 43200 -j REDIRECT --to-ports 32400

iptables -t mangle -I PREROUTING -p tcp -d YOUR_PUBLIC_IP_HERE --dport 32400 -j MARK --set-mark 1

iptables -I INPUT -p TCP -m mark --mark 1 -j REJECT --reject-with tcp-reset

3: Don't forget to setup plex.yourdomain.com to point to your IP, and update the configs

4: You can now setup basic auth for the hostname

5: You can get a free SSL cert

6: Don't forget to go into the server settings for plex in the web interface, and specify a manual port for remote access (43200 as above).

7: Verify your firewall is working with:

nmap -p 32400 YOUR_PUBLIC_IP_HERE