DDoS Updates

[Sisifo]

Are you online now? I can not connect.


My public IP is 85.***.221.27. The website says:

"Your current connection is not on the whitelist."

When I try to connect, the client stays on "Connecting...".

From Linux, I also tested the realm connection directly:

play.octowow.st → 92.114.107.111

92.114.107.111:3724 times out, while the TCP connection never receives a SYN-ACK.

Could you please check whether my IP is being blocked by the server firewall/DDoS protection or needs to be whitelisted?

Thank you.

Same issue here on Linux over the weekend... SYN sent, no SYN-ACK ever comes back, it just times out. Not my network, tested 3 different source IPs so ruled out ISP, VPN, and local stuff. I made a few changes and had immediate success. The login is slow though, like it is fighting through the handshake, but it slowly gets through and was in.

sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.48 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.59 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_timestamps=0
sudo sysctl -w net.ipv4.tcp_window_scaling=0

Swap the IPs for whatever yours resolves to if different, I've seen at least 3 in the rotation (.48, .59, .111). Window scaling being off will cap your max throughput on big downloads but doesn't matter for gameplay.... Can revert anytime by flushing the mangle rule and flipping those two sysctls back to 1.

Actual god , this worked for me thank you

Woooow, thanks buddy ... works like a charm!! on Ubuntu .

[Twisted6]

Are you online now? I can not connect.


My public IP is 85.***.221.27. The website says:

"Your current connection is not on the whitelist."

When I try to connect, the client stays on "Connecting...".

From Linux, I also tested the realm connection directly:

play.octowow.st → 92.114.107.111

92.114.107.111:3724 times out, while the TCP connection never receives a SYN-ACK.

Could you please check whether my IP is being blocked by the server firewall/DDoS protection or needs to be whitelisted?

Thank you.

Same issue here on Linux over the weekend... SYN sent, no SYN-ACK ever comes back, it just times out. Not my network, tested 3 different source IPs so ruled out ISP, VPN, and local stuff. I made a few changes and had immediate success. The login is slow though, like it is fighting through the handshake, but it slowly gets through and was in.

sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.48 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.59 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_timestamps=0
sudo sysctl -w net.ipv4.tcp_window_scaling=0

Swap the IPs for whatever yours resolves to if different, I've seen at least 3 in the rotation (.48, .59, .111). Window scaling being off will cap your max throughput on big downloads but doesn't matter for gameplay.... Can revert anytime by flushing the mangle rule and flipping those two sysctls back to 1.

I can't believe this actually worked. So the DDoS filter is now blocking Linux, great.

For others the full working console command with current IPs as of this comment date is:
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.111 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.53 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_window_scaling=0

And to reverse the changes enter the following or just reboot:
sudo iptables -t mangle -D OUTPUT -p tcp -d 92.114.107.111 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -D OUTPUT -p tcp -d 92.114.107.53 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_window_scaling=1


If you want to check what he current IPs are enter:
ping play.octowow.st
ping normal.octowow.st (or hardcore/pvp if that's your realm)

[Hataph]

Thanks to @Tinmann for the great find.
I am using Ubuntu and changing TTL to 128 (default is 64) seem to work for me.
Further reading, it seem Blizzard also have similar issue after DDOS attack during 2019.
It could be the DDOS protection is using passive fingerprinting to sniff/filter assumed Linux DDOS bot from accessing the OctoWoW server.
Normal Linux users like me is collateral damage.
Do hope OctoWow admin/dev can verify on the passive fingerprinting theory thou.

https://us.forums.blizzard.com/en/wow/t ... 8/291589/1
https://medium.com/thg-tech-blog/finger ... ee32ddf07a

For Windows user, try check your current Default Hop Limit setting (default should be 128 on windows 10/11).

netsh int ipv4 show global
netsh int ipv4 set global defaultcurhoplimit=128

Or if you are using Linux-based firewall/router for internet connection, check the TTL setting as well.

[Lokri]

That is absolutely wild what those linux users have to go through just to play... This is actually complete insanity at this point, you basically need to know IT just to connect. I am also convinced most of the people with zero issues have been whitelisted and it's not public. I am absolutely being blocked from connecting and after wasting a lot of time trying different solutions nothing works. I am NA East Coast and have never experienced this level of lock out even with a VPN, this is just absolute insanity to continue on like this for me. I appreciate the afford and respect the hell out of the community, but this just isn't going to work out on the long run for anyone. The connection issues will deter new players and the release of Forever will seal the fate of all of this.

[Rear]

It worked for me too, but the IPs were different. So make sure to check them with ping.
Thx alot

Are you online now? I can not connect.


My public IP is 85.***.221.27. The website says:

"Your current connection is not on the whitelist."

When I try to connect, the client stays on "Connecting...".

From Linux, I also tested the realm connection directly:

play.octowow.st → 92.114.107.111

92.114.107.111:3724 times out, while the TCP connection never receives a SYN-ACK.

Could you please check whether my IP is being blocked by the server firewall/DDoS protection or needs to be whitelisted?

Thank you.

Same issue here on Linux over the weekend... SYN sent, no SYN-ACK ever comes back, it just times out. Not my network, tested 3 different source IPs so ruled out ISP, VPN, and local stuff. I made a few changes and had immediate success. The login is slow though, like it is fighting through the handshake, but it slowly gets through and was in.

sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.48 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.59 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_timestamps=0
sudo sysctl -w net.ipv4.tcp_window_scaling=0

Swap the IPs for whatever yours resolves to if different, I've seen at least 3 in the rotation (.48, .59, .111). Window scaling being off will cap your max throughput on big downloads but doesn't matter for gameplay.... Can revert anytime by flushing the mangle rule and flipping those two sysctls back to 1.

I can't believe this actually worked. So the DDoS filter is now blocking Linux, great.

For others the full working console command with current IPs as of this comment date is:
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.111 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.53 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_window_scaling=0

And to reverse the changes enter the following or just reboot:
sudo iptables -t mangle -D OUTPUT -p tcp -d 92.114.107.111 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -D OUTPUT -p tcp -d 92.114.107.53 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_window_scaling=1


If you want to check what he current IPs are enter:
ping play.octowow.st
ping normal.octowow.st (or hardcore/pvp if that's your realm)

[Sqweellex]

YOU ARE PLAYING A FREE VERSION OF AN OTHERWISE PAID SUBSCRIPTION PRODUCT YOU UNGRATEFUL BASTARDS!

Many people have spent more on donations to this server than the cost of an official server subscription over the same period. Naturally, those who donated expect a decent level of service. If the administration has undertaken a commercial project, they are duty-bound to provide a properly functioning service. Let me let you in on a little secret: no private server is created by fans for fans; they are created by developers with one sole objective—to make money!

As for mitigating DDoS attacks—in 20 years, this is the first time I’ve seen a server unable to resolve a DDoS issue within a day or two at most. I’ve never seen anything like it. Here, the problem hasn't been fixed for 45 days.

Regarding the player count: before the DDoS attacks began, the population exceeded 4,000 players. What is it now? Not even 3,000 during peak hours on the weekend? And how many more will drop off once the official server launches?

Many have already resigned themselves to the fact that Okto will never work properly and are simply waiting for the official launch (though I won't be going there). However, many people play here casually while waiting for the official release. And plenty of players who hadn't even considered the official server will end up going there for one simple reason: it works there, but not here.

[Wh1tehollow]

For Windows, go to: C:\Windows\System32\drivers\etc (select "All files")
Locate the HOSTS text file and add the following to the very end, leaving a blank space:
92.114.107.56 play.octowow.st
92.114.107.56 normal.octowow.st

[Jolly279]

Are you online now? I can not connect.


My public IP is 85.***.221.27. The website says:

"Your current connection is not on the whitelist."

When I try to connect, the client stays on "Connecting...".

From Linux, I also tested the realm connection directly:

play.octowow.st → 92.114.107.111

92.114.107.111:3724 times out, while the TCP connection never receives a SYN-ACK.

Could you please check whether my IP is being blocked by the server firewall/DDoS protection or needs to be whitelisted?

Thank you.

Same issue here on Linux over the weekend... SYN sent, no SYN-ACK ever comes back, it just times out. Not my network, tested 3 different source IPs so ruled out ISP, VPN, and local stuff. I made a few changes and had immediate success. The login is slow though, like it is fighting through the handshake, but it slowly gets through and was in.

sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.48 --dport 3724 -j TTL --ttl-set 128
sudo iptables -t mangle -A OUTPUT -p tcp -d 92.114.107.59 --dport 3724 -j TTL --ttl-set 128
sudo sysctl -w net.ipv4.tcp_timestamps=0
sudo sysctl -w net.ipv4.tcp_window_scaling=0

Swap the IPs for whatever yours resolves to if different, I've seen at least 3 in the rotation (.48, .59, .111). Window scaling being off will cap your max throughput on big downloads but doesn't matter for gameplay.... Can revert anytime by flushing the mangle rule and flipping those two sysctls back to 1.

You a g! Worked instantly on macOS 27 too, via

Code: Select all

sudo sysctl -w net.inet.ip.ttl=128

[Hataph]

For Windows, go to: C:\Windows\System32\drivers\etc (select "All files")
Locate the HOSTS text file and add the following to the very end, leaving a blank space:
92.114.107.56 play.octowow.st
92.114.107.56 normal.octowow.st

This does work too but i only need to hardcode IP for play.octowow.st.

[Quizok2]

For Windows, go to: C:\Windows\System32\drivers\etc (select "All files")
Locate the HOSTS text file and add the following to the very end, leaving a blank space:
92.114.107.56 play.octowow.st
92.114.107.56 normal.octowow.st

That works. What sorcery is this lol.