attack on port 1433

[Midorimachi]

You must be registered to see links

You must be registered to see links

Here sir

and also my website always in a black page. Sometimes its ok, sometimes not

 

[Solaire]

You should move the addresses from local to remote.

 

[Midorimachi]

The ip addresses should be in remote ? not in local?

 

[evilwhynot]

Just null out those ips coming to the server if you cant do it then get your provider to do it

 

[Midorimachi]

Those ips are proxy only, if i could only detect the real ip that would be easy

 

[Mootie]

Just null out those ips coming to the server if you cant do it then get your provider to do it

Yeah, then you tell provider to ACL the IPs and by the time they do it, your server's offline for 30minutes. This isn't a practical solution, especially considering it isn't hard to find new proxies. Not to mention if the attack is very large(larger than your uplink), you won't be able to collect all of the IPs at a software level because your NIC will be maxed out.

Anyways, port 1433 is a port that only should be accessed by servers or administrators. Having it public is a significant security threat. Block all incoming connections to this port except the ones from your servers or VPN. This is pretty basic stuff, I recommend that you do some research or take classes on network security before running a game server yourself.

By the way, any chance the attacking IPs are from China? There are tons of Chinese password bruiting bots. I had a dedicated server provisioned once and I didn't configure it for a couple days(nor did I use the IP for anything). I check event logs and it's spammed with windows login attempts coming from Chinese IPs. Luckily, it didn't appear to have broken in. I changed the password and setup a lockout policy afterwards, just to be sure. This is why you should know network security basics before renting any sort of dedicated machine.

 

[Midorimachi]

Ok thank your for that great advice sir mootie. I will keep that in mind.
Yes those proxy ips are from china.

 

[Solaire]

The ip addresses should be in remote ? not in local?

Yeah, and then change from block to allow. That way it'll only accept connections from the IP's you've added.

 

[Midorimachi]

then the i will change the block connection to allow? ok ill try it thank you.

 

[Midorimachi]

the problem still occurs.
my mssql server still having the same problem

 

[MAXTRAXv3]

what you getting report ppl are TRYING to attack you?
trying not reading it? lol they still gonna try.