DDoS/Dice Vulnerability and P2P Security Measures in Metin2 Pvp Servers
The most targeted points of Metin2 pvp servers by cyber attackers are P2P (Peer-to-Peer) ports and Dice vulnerabilities. By using these vulnerabilities, attackers can downgrade in-game channels (CH), crash the server, or grant themselves invalid permissions. In this guide, we have compiled the steps you need to take to ensure your server security and prevent these attacks.
1. Closing P2P Ports to the Outside World (Most Critical Measure)
P2P ports allow game channels to exchange data between themselves. If these ports remain open to the outside, attackers can gain admin privileges or close the channels by sending fake commands to the server. For the solution, you must activate the FreeBSD firewall (IPFW or PF):
- your server with Filezilla
/etc/rc.confOpen the file and enable the firewall by adding these lines:
firewall_enable="YES" firewall_script="/etc/ipfw.rules"
- Then
/etc/ipfw.rulesCreate a file called , allow the ports of the game that need to be open to the outside (Input port, CH ports), and write as written in your CONFIG files. P2P ports only on localhost (127.0.0.1) Add a rule to listen.
2. P2P Security Setting in CONFIG Files
If you are not using sourced files and the ipfw settings are complicated, you can limit P2P connections to within the server only from the CONFIG file of each channel:
/usr/game/cores/channel1/CONFIGOpen the file.- Add the following command to the bottom line of the file:
bind_ip 127.0.0.1 - Thanks to this command, that channel will reject direct port listening requests from external networks. Repeat this process on all CH, Auth and Game99 CONFIG files.
3. Disabling the "Dice" Vulnerability Command
In older generation or unprotected files, players could loop the game engine and drop CH by typing a specific dice command (`/dice`) in the chat line. To close this gap:
- If you have source code,
cmd.cppOpen the file andACM(do_dice)by deleting the line completely or beginning//disable the command completely and recompile source. - If you are not using sourced files, you can download an in-game quest (Lua script) Use filters that automatically kick the player out of the game or block the word when the word "/dice" is mentioned in the chat line by typing.
This article is specially prepared for PvPServer.
