Getting started Examples

Examples rulesets to start from, each with its cases.

The moat-examples repository has rulesets for game servers, for running a host, for single attack vectors and for migrating from iptables or nftables. Every folder has the rules, a case file that shows what they do, and a README with what they were measured to do in the kernel.

$ git clone https://github.com/moatfw/moat-examples
$ cd moat-examples/game/minecraft-java
$ moat check minecraft-java.moat
$ sudo moat test minecraft-java.moat minecraft-java.toml

Off Linux, or with --model, moat test runs the cases in moat's model of the program, without root.

Game servers

In game/. All of them are default pass and only touch the game's own ports, so their rules can be pasted into one file with an admin/ ruleset for the rest of the host; an interface runs one program.

Game	Folder	What it stops
Minecraft Java	`game/minecraft-java`	Bot joins, ping floods, connection floods, legacy ping scanners, UDP floods; a login cap to switch on during an attack.
Minecraft Bedrock	`game/minecraft-bedrock`	Spoofed RakNet pings (amplification), session open floods, malformed RakNet, floods from one source.
Rust	`game/rust`	A2S query floods, junk on the query port, reflected answers, floods from one source; RCON for admins only.
CS2, Garry's Mod, TF2 and other Source games	`game/source-server`	Reflected answers, malformed UDP, A2S query floods, floods from one source; SSH for admins only.
FiveM	`game/fivem`	Sources that never send the FiveM handshake, player list scrapers.

Running a host

In admin/.

Folder	What it does
`admin/management-ports`	Admin panels, databases, Docker, exporters: reachable from the admin networks only.
`admin/ssh`	SSH open to the internet: password guessing limited, guessers banned for an hour.
`admin/wireguard`	Admin access only through WireGuard: handshake floods and malformed messages dropped, SSH closed on the public side.
`admin/icmp-policy`	Keeps path MTU discovery and neighbour discovery working, budgets pings and error floods, drops the rest.
`admin/blocklist`	Published blocklists and bans from scripts or fail2ban, with the admins always let in.
`admin/country-allowlist`	Game traffic only from the countries the players are in.
`admin/emergency-mode`	One `moat var set` turns the host into known players and admins only, and back.
`admin/web-server`	A complete default-drop ruleset for a web server.

One attack at a time

ddos/ has ten folders, one per attack vector: SYN, ACK and RST floods, bad TCP flags, UDP floods, UDP amplification, VSE queries, GRE, fragments, spoofed sources and HTTP floods. Each has the rules, the cases and a README with what the limit allows in throughput, the cost per packet measured with moat bench, and its caveats, plus live results from a loaded interface.

Migrating

migration/iptables and migration/nftables walk through importing iptables and importing nftables rules, with the input, the importer's output exactly as produced, and cases for the result. The iptables one carries an ipset over with --ipsets.

Before using one

Per-source budgets assume one address is one client. Exempt reverse proxies, CDNs, load balancers and other addresses that put many users behind one source first. The figures are lab numbers from the kernel's test runner, not guarantees for a server under attack.

Exempting a list of proxies takes one rule placed before the others:

set proxies from "proxies.txt"
rule proxies { when ip.src in proxies then pass }

The addresses in the examples are documentation ranges: put your own networks in admins.txt and the other set files. Load new rules with --audit first and check moat stats before enforcing them:

$ sudo moat load minecraft-java.moat --iface eth0 --audit
$ sudo moat stats --iface eth0
$ sudo moat audit off --iface eth0