Teeworlds - bridge

does anyone of you have fail2ban rules for teeworlds? Of course teeworlds doesn't have a login, but you can rate limit connection attempts from the same ip

12:35

the interesting part is the failregex which reads the teeworlds logs

You mean all connections right? Not just rcon attempts? Because if you find a rule for rcon attempts let me know :) currently all my tw servers can be rcon password bruteforced and the retry counter restarts on reconnect

14:11

Also are you talking about THE fail2ban thing that is used for ssh? Or just general firewall rules? I did not know fail2ban is that customizable

14:15

Oh yea seems like it is. I always thought fail2ban is some network packet inspector from 1907 written in C but seems to be just a log parser in python :D But does the tw server even log to the file which fail2ban looks at?

14:18

Oh yea seems like this is the option to specify the log https://github.com/fail2ban/fail2ban/blob/master/man/fail2ban-server.1#LL28C8-L28C17

fail2ban/fail2ban-server.1 at master · fail2ban/fail2ban

Daemon to ban hosts that cause multiple authentication errors - fail2ban/fail2ban-server.1 at master · fail2ban/fail2ban

14:18

So you would just need a regex for the player is ready log message i assume? https://github.com/chillavanilla/TeeworldsEconMod/blob/fbc0198c33b552ba1460b4c705eafbc8d5686f33/test/logs/075_new_id_format.log#L45

TeeworldsEconMod/075_new_id_format.log at fbc0198c33b552ba1460b4c70...

A python script which communicates with teeworlds server log as input and econ connection as output. - TeeworldsEconMod/075_new_id_format.log at fbc0198c33b552ba1460b4c705eafbc8d5686f33 · chillavan...

I did not test but something like that should work \[\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\]\[server\]: player is ready. ClientID=\d addr=<HOST>:\d+

14:30

failregex = ^\[\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\]\[server\]: player is ready. ClientID=\d addr=<HOST>:\d+$

14:32

If you try to fix ddos or something like that it might not help. Because there are a lot of packages exchanged before the "player is ready" message is being printed

14:33

6 packets minimum have already been exchanged at this stage https://chillerdragon.github.io/teeworlds-protocol/07/traffic.html#cl_srv_ready

Assa

does anyone of you have fail2ban rules for teeworlds? Of course teeworlds doesn't have a login, but you can rate limit connection attempts from the same ip

wasn't that implemented directly ? lol

it is generally used as a firewall tool, I use it for my nextcloud, too. I am not worried about the person who tries to connect 5 dummies to a teeworlds server, I am worried about the person who tries 100 tcp connections at once

15:56

you can configure the file fail2ban looks at, and I want to look at the server log and regex parse it

I meant the same IP on teeworlds directly

15:57

there was an option if you flood

banning at the firewall is one level higher than in teeworlds, thanks for the regex, I'll have a look at it

well 1st it's udp, and 100 connections at once doubt it'll do huge damage

also with fail2ban you can ban rcon attempts as long as they are from the same IP, you can't do much against distributed attacks

for me it's a bit overkill to use it

really, let me have a look and I give you some stats

16:04

today I already banned 8 people trying to login into the server with ssh with it

yes ssh because it doesn't implement any "ban" after x fail attempt

16:05

even it's more useless when you disable password auth & only use ssh keys

16:06

but for teeworlds (maybe it's only ddnet?) there's a rcon command to say "if I receive too much connection requests, I ban the IP for 1min"

16:10

ah maybe there's not even a cmd, but it's there

thank you ^^ I hope my security measures are well enough