7 Commits
1.0.0 ... 1.0.2

Author SHA1 Message Date
80b2d2de15 fix short param 2021-08-01 21:54:49 +03:00
5fe959e236 Update README.md 2021-08-01 18:20:32 +03:00
3c1a7b60cd Update README.md 2021-08-01 07:11:34 +03:00
1e2d97598f Update README.md 2021-08-01 06:56:25 +03:00
2f742f9929 Update README.md 2021-08-01 06:44:52 +03:00
86f3f9af52 Update readme 2021-08-01 02:51:21 +03:00
2b5d7bdc8c fix Makefile 2021-08-01 00:08:53 +03:00
5 changed files with 82 additions and 9 deletions

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
bin

View File

@ -1,7 +1,7 @@
NAME = kf2-antiddos NAME = kf2-antiddos
VERSION := $(shell git describe) VERSION := $(shell git describe)
GOCMD = go GOCMD = go
LDFLAGS := "$(LDFLAGS) -s -w -X 'main.Version=$(VERSION)'" LDFLAGS := "$(LDFLAGS) -s -w -X 'main.AppVersion=$(VERSION)'"
GOBUILD = $(GOCMD) build -ldflags=$(LDFLAGS) GOBUILD = $(GOCMD) build -ldflags=$(LDFLAGS)
SRCMAIN = ./cmd/$(NAME) SRCMAIN = ./cmd/$(NAME)
SRCDOC = ./doc SRCDOC = ./doc
@ -35,7 +35,7 @@ linux-amd64: prep
windows-amd64: prep windows-amd64: prep
GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BIN)-windows-amd64.exe $(SRCMAIN) GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BIN)-windows-amd64.exe $(SRCMAIN)
compile: linux-386 windows-386 linux-amd64 windows-amd64 compile: linux-amd64 windows-amd64
install: check-build doc install: check-build doc
install -m 755 -d $(PREFIX)/bin/ install -m 755 -d $(PREFIX)/bin/

View File

@ -1 +1,73 @@
# KF2-AntiDDoS # KF2-AntiDDoS
Compiled versions for windows and linux are available on the [releases page](https://github.com/GenZmeY/KF2-AntiDDoS/releases).
But you can build it yourself, for this there is a Makefile.
## How it works
The program parses the output of the KF2 server(s) and counts the number of connections. If the number of connections from one IP exceeds the threshold and it is still not known that this is a player, the program will execute a deny script passing it the IP as an argument.
The program will periodically execute the allow script, passing it a set of IPs blocked in the last period.
## HowTo:
```
Usage: <kf2_logs_output> | kf2-antiddos [option]... <shell> <deny_script> <allow_script>
kf2_logs_output KF2 logs to redirect to stdin
shell shell to run deny_script and allow_script
deny_script firewall deny script (takes IP as argument)
allow_script firewall allow script (takes IPs as arguments)
Options:
-j, --jobs N allow N jobs at once
-o, --output MODE self|proxy|all|quiet
-t, --deny-time TIME minimum ip deny TIME (seconds)
-c, --max-connections N Skip N connections before run deny script
-v, --version Show version
-h, --help Show help
```
- Prepare an IP deny script for your firewall. The script must block the IP received by the first argument
- Prepare an IP set allow script for your firewall. The script must unblock the set of IPs given by the arguments
- Сreate a redirection of the output of all KF2 servers to the stdin of the program
- In the parameters specify the scripts that you prepared and the shell that will execute them
## Centos example
(change paths and values as you need)
### systemd service:
```
[Unit]
Description=kf2-antiddos
After=network-online.target
Wants=network-online.target
[Service]
User=root
Group=root
Type=simple
ExecStart=/bin/sh -c '/usr/bin/kf2-srv log tail | /usr/local/bin/kf2-antiddos-linux-amd64 /bin/bash /usr/local/share/kf2-antiddos/deny.sh /usr/local/share/kf2-antiddos/allow.sh'
Restart=on-failure
[Install]
WantedBy=multi-user.target
```
### deny.sh
```
#!/bin/bash
firewall-cmd --add-rich-rule="rule family=ipv4 source address=$1 port port=7777-7815 protocol=udp reject"
firewall-cmd --add-rich-rule="rule family=ipv4 destination address=$1 reject"
```
### allow.sh
```
#!/bin/bash
for IP in $@
do
firewall-cmd --remove-rich-rule="rule family=ipv4 source address=$IP port port=7777-7815 protocol=udp reject"
firewall-cmd --remove-rich-rule="rule family=ipv4 destination address=$IP reject"
done
```
## Contributing
It would be great if someone set up, tried it on windows and share their experience

View File

@ -19,8 +19,8 @@ func printHelp() {
output.Println("Options:") output.Println("Options:")
output.Println(" -j, --jobs N allow N jobs at once") output.Println(" -j, --jobs N allow N jobs at once")
output.Println(" -o, --output MODE self|proxy|all|quiet") output.Println(" -o, --output MODE self|proxy|all|quiet")
output.Println(" -dt, --deny-time TIME minimum ip deny TIME (seconds)") output.Println(" -t, --deny-time TIME minimum ip deny TIME (seconds)")
output.Println(" -mc, --max-connections N Skip N connections before run deny script") output.Println(" -c, --max-connections N Skip N connections before run deny script")
output.Println(" -v, --version Show version") output.Println(" -v, --version Show version")
output.Println(" -h, --help Show help") output.Println(" -h, --help Show help")
} }
@ -38,10 +38,10 @@ func parseArgs() config.Config {
gnuflag.StringVar(&rawCfg.OutputMode, "o", "", "") gnuflag.StringVar(&rawCfg.OutputMode, "o", "", "")
gnuflag.StringVar(&rawCfg.OutputMode, "output", "", "") gnuflag.StringVar(&rawCfg.OutputMode, "output", "", "")
gnuflag.UintVar(&rawCfg.DenyTime, "dt", 0, "") gnuflag.UintVar(&rawCfg.DenyTime, "t", 0, "")
gnuflag.UintVar(&rawCfg.DenyTime, "deny-time", 0, "") gnuflag.UintVar(&rawCfg.DenyTime, "deny-time", 0, "")
gnuflag.UintVar(&rawCfg.MaxConn, "mc", 0, "") gnuflag.UintVar(&rawCfg.MaxConn, "c", 0, "")
gnuflag.UintVar(&rawCfg.MaxConn, "max-connections", 0, "") gnuflag.UintVar(&rawCfg.MaxConn, "max-connections", 0, "")
gnuflag.BoolVar(&rawCfg.ShowVersion, "v", false, "") gnuflag.BoolVar(&rawCfg.ShowVersion, "v", false, "")

View File

@ -9,7 +9,7 @@ allow_script firewall allow script (takes IPs as arguments)
Options: Options:
-j, --jobs N allow N jobs at once -j, --jobs N allow N jobs at once
-o, --output MODE self|proxy|all|quiet -o, --output MODE self|proxy|all|quiet
-dt, --deny-time TIME minimum ip deny TIME (seconds) -t, --deny-time TIME minimum ip deny TIME (seconds)
-mc, --max-connections N Skip N connections before run deny script -c, --max-connections N Skip N connections before run deny script
-v, --version Show version -v, --version Show version
-h, --help Show help -h, --help Show help