#!/bin/sh

iptables -F

# Call of Duty DDoS Fix

iptables -A OUTPUT -p UDP -m length --length 1162:1168 -j DROP
iptables -A FORWARD -p UDP -m length --length 1162:1168 -j DROP
iptables -A INPUT -p UDP -m length --length 1162:1168 -j DROP
iptables -A INPUT -p UDP -m length --length 42 -m recent --set --name getstatus_cod
iptables -A INPUT -p UDP -m string --algo bm --string "getstatus" -m recent --update --seconds 1 --hitcount 20 --name getstatus_cod -j DROP

# Quake 3+4 DDoS Fix

iptables -N quake3_ddos
# accept real client/player traffic

iptables -A quake3_ddos -m u32 ! --u32 "0x1c=0xffffffff" -j ACCEPT

# match "getstatus" queries and remember their address
iptables -A quake3_ddos -m u32 --u32 "0x20=0x67657473&&0x24=0x74617475&&0x25&0xff=0x73" -m recent --name getstatus --set

# drop packet if "hits" per "seconds" is reached
#
# NOTE: if you run multiple servers on a single host, you will need to higher these limits
#       as otherwise you will block regular server queries, like Spider or QConnect
#       e.g. they will query all of your servers within a second to update the list
iptables -A quake3_ddos -m recent --update --name getstatus --hitcount 10 --seconds 3 -j DROP

iptables -A quake3_ddos -j ACCEPT
iptables -I INPUT 1 -p udp -j quake3_ddos

iptables -L -n

exit 0