Questions[syn](server)

i am trying to figure out how to achieve something am not sure is achievable and need help. I did my research but couldnt find credible information. Hope this question is not duplicate.

SET UP: I am using iptables as my firewall to block malicious ip activity. currently i am manually writing the entries in a file and then execute with iptables-restore < /etc/iptables/rules. Within those rules i have one that logs every inbound connection -A INPUT -m state --state NEW -j LOGALL. I have also set up apache to log ip that connect to the webpages. (different logs for each page, and different log file for iptables)

PROBLEM: I get numerous iptables logs of this kind:

Apr  4 14:52:18 kernel: [53326.219105] LOGALL IN=eth0 OUT= MAC=xxxxxxxxxxxx SRC=174.111.111.206 DST=192.168.1.5 LEN=44 TOS=0x00 PREC=0x00 TTL=244 ID=40132 PROTO=TCP SPT=179 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0 
Apr  4 14:53:27 kernel: [53395.130551] LOGALL IN=eth0 OUT= MAC=xxxxxxxxxxxx  SRC=45.146.164.211 DST=192.168.1.5 LEN=44 TOS=0x04 PREC=0x00 TTL=247 ID=26977 PROTO=TCP SPT=55172 DPT=443 WINDOW=1024 RES=0x00 SYN URGP=0 

from thousands of different IPs per day. I can tell from the LOG that they only send a SYN packet. I have used Wireshark to inspect the traffic and what i can tell is most dont answer after my server responds with SYN,ACK

54215   187.717006840   180.234.40.115  192.168.1.5 TCP 60  56412 ? 443 [SYN] Seq=0 Win=5840 Len=0 MSS=1460
54216   187.717251257   192.168.1.5 180.234.40.115  TCP 58  443 ? 56412 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460
54411   188.716638340   192.168.1.5 180.234.40.115  TCP 58  [TCP Retransmission] 443 ? 56412 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460

I have tried many differnt ways with iptables to limit those SYN only packets. But those connections are not SYN floods attacks (i have limited SYN connections), but probably some crawlers and scans. I also tried https://inai.de/documents/Chaostables.pdf which gave me a lot of hope....but it didnt work or i cant get it to work.

I have also looked into fail2ban (havent used it yet), but since i write the entries to iptables myself and execute with iptables-restore < /etc/iptables/rules, and failt2ban uses iptables too, i dont know how would both work together.

QUESTION: Is it possible to block IPs that show up in iptables's LOG file but do NOT show in apache LOG files? (for me that would mean the IP did not come to my server to open the webpage, thus is doing smth else) example: 1.1.1.1 IP opens my webpage, meaning there will be LOG in iptables and in apache. BUT if that 1.1.1.1 IP only sends SYN packet to port 443, only iptables LOG will show that -> block that ip?

I hope i have been clear enough. Any help would be appreciated. Thank you

When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server:

netstat -npt  | grep SYN_RECV | awk '{print $5}' | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' | cut -d: -f1 | sort | uniq -c | sort -nr | head | tee -a $REPORT_FILE 

Example of output:

Single attack IP - DOS:
  262 187.7.214.146
  1   95.90.250.96
  1   83.215.15.150
  1   203.160.112.239
  1   124.197.39.213

Multiple attack IPs - DDOS:  
  316 187.7.214.146
  94  187.7.214.96
  44  187.7.214.150
  90  203.160.112.239
  22  203.160.112.222

I read somewhere that if the number of SYN_RECV request of an IP is more than 4 then, it's consider to make SYN flood attack (DOS). I have few questions:

1) What is the exact number that we can declare an IP(DOS) or IPs (DDOS) are making the attack when using this netstat command ? If the IP is connecting with SYN_RECV state, does that mean he is doing SYN flood attack? Can it be false flag ?

2) IS SYN_RECV is the only listening state that a DDOS attacker used? What about the ESTABLISHED state ? I'm confused because other articles said that if some foreign IPs are connected with ESTABLISHED state, then my server is being attacked. What kind of attack

3) I ask this question because I want to make a simple bash script that can manually report if the IP is an attacker and I have been told to use the SYN_RECV state to evaluate the attacker. Is that the only state we can use?. What is the minimum value of SYN_RECV value that can be considered as safe (NOT DOS ATTACKER)?

Hopefully that my question is clear. Please ask me if something is not clear.

Thank you and I hope somebody could answer this nightmare.

I have a virtual environment and Iam making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.

I realized that a countermeasure for this attack is to limit or block the responses to the SYN packets, which are the SYN,ACK.

But how can I do this with iptables?

What else should be done to prevent that kind of attacks?

Any help would be appreciated.

I am using tcpdump to capture traffic from specific IP address. Is there the possibility to capture new connections only, meaning TCP streams that start with SYN packet?

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast.

However, the server appears to sometimes have "SYN flooding" attacks. I really believe/suspect these are intentional and not caused by our legit users. (as they appear to happen when there are some individuals that register new accounts and try to cause trouble)

Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.

Unfortunately, when that happens, my whole traffic is affected:

[Mon Jun 27 22:15:28.842067 2016] [mpm_event:error] [pid 12022:tid 132875292207712] AH00485: scoreboard is full, not at MaxRequestWorkers

My MaxRequestWorkers is 600. I have increased it a few times in the past.
Recently I also have increased net.ipv4.tcp_max_syn_backlog and ListenBackLog to 5000.
My server has 16GB RAM and 1 Gbps bandwidth.

I am not really happy that there appears to be someone that can easily control whether my website is alive or not.
What can one do to stop this?

Also, netstat seems to give me the IPs connected to the server right now.
Is it possible to get the top IPs at a given time in the past?