This tutorial will explain how to set up and configure a DDoS protected 7 Days to Die (7DtD) server. This guide assumes you already have a running 7DtD server and access to your 7DtD server you wish to protect.
Step 1: Backend Setup
Setup 7DtD on your server, this server will be from here on referred to as the "backend server". On the backend server you may use whichever Operating System you are most familiar with, however if unsure we recommend Debian Linux.
Please ensure that the service is running and connectible on the backend server.
Step 2: Purchase DDoS Protection Service
Choose a billing cycle, a service tier/network and the clean-bandwidth allowance on the DDoS protection page, then click Continue to Checkout. On Complete Order, review the filtering region when offered, enter a Service Name, and review the Order Summary before submitting your order. Choose a region close to your backend and users; clean bandwidth measures delivered traffic, not attack traffic. If you already have a suitable active service, continue with that service.
Step 3: Encapsulation Setup (Optional)
This step is only required if you are intending to use a GRE or IP-in-IP tunnel. If you are intending to use a Reverse Proxy (RP) style connection (the easiest) then you can skip this step.
A Reverse Proxy only proxies connections to your backend and can be useful for servers that do not require to set bans on player IP addresses or do not have command line skills to set up a network interface (or when using a panel that does not give access to console).
An encapsulated backend requires support on the Backend Server, currently Windows and Linux Operating Systems are fully supported, with partial support for FreeBSD. Most Enterprise or even SOHO Routers also support GRE or IP-in-IP tunneling, if supported you may be able to configure the router to terminate the encapsulated network.
Open Services, find your service, and choose Action > Tunnels. Click Add Tunnel, select GRE in Tunnel type, and enter the backend server's public IP in Backend address. Retain the displayed GRE key unless your backend requires a tunnel without one, then click Save. The integrated form below is an alternative way to configure the same tunnel.
The completed example uses 203.0.113.10 as a documentation-only backend address, GRE key 1785302134, and MTU 1472. Replace the backend address with your server’s public IP and use the same key and MTU when configuring that server.
After saving a port that uses this tunnel in Step 4, return to Tunnels and choose the tunnel's Action > Setup Tunnel. Select Linux / BSD and Download Tunnel Script, or Microsoft Windows and Download Application, as appropriate for your backend. The tunnel must be referenced by an Encapsulated port before it is usable. Install the downloaded script or application on your backend using the linked operating-system instructions.
See the GRE/IP-in-IP tunnel setup instructions.
Setup 7DtD server for Tunnel communication
The 7DtD server does not include an option to bind to a specific interface, in this case it is not possible to directly bind to the filtered tunnel. As is this is requirement due to the networking method used internally a LD_PRELOAD injected shared object must be used to introduce this functioanlity. A guide for this can be found here. Follow this guide to compile and install the shared object. Currently (Alpha8) the Dedicated server version used on Linux is usually 32bit, and hence the LD_PRELOAD shim should be compiled for 32bit Linux.
The shim can be included in the default management scripts by editing
/usr/local/lib/7dtd/commands/start.shFind the line starting with:
LD_LIBRARY_PATH=$SDTD_BASE/linux_files LC_ALL=C $SSD [...]
Replace this with:
LD_LIBRARY_PATH=$SDTD_BASE/linux_files LC_ALL=C BIND_ADDR="10.17.24.12" LD_PRELOAD=/usr/lib/bind32.so $SSD [...]
Where 10.17.24.12 is the internal IP address of your backend. This can be retreived using ifconfig.
# ifconfig gre2
gre2 Link encap:UNSPEC HWaddr 6C-3D-CF-72-00-00-B0-B6-00-00-00-00-00-00-00-00
inet addr:10.17.24.14 P-t-P:10.17.24.14 Mask:255.255.255.252
UP POINTOPOINT RUNNING NOARP MTU:1180 Metric:1
RX packets:30826 errors:0 dropped:0 overruns:0 frame:0
TX packets:41206 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2782629 (2.6 MiB) TX bytes:6674435 (6.3 MiB)
Step 4: Add Ports
Add the ports required to run your service. In this case, the port range for 7DtD servers is 25000 25003 and communication occurs over the UDP protocol. If unsure you can determine what port(s) the service bound to by using the ss or netstat commands as appropriate.
Open Services, find your service, and choose Action > Ports. Select Port Range > Add Port Range, enter 25000 in Port start and 25003 in Port end, and choose UDP in Protocol. Set Backend method to Reverse Proxy with your Backend address, or choose the available Encapsulated method and the tunnel created in Step 3. Click Save and check the saved range. For an additional individual port, select Single Port and click Add port manually when Add your first port is shown; otherwise click Add Port.
The completed example uses 203.0.113.10 as a documentation-only backend address. Replace it with your backend address, or select the GRE tunnel you created when using encapsulation.
Step 5: Finish & Test
Once all steps are completed and the progress bar for deployment of the configuration reaches 100% you should be able to connect to your service on your Filtered IP.
This Filtered IP is the address that you should use in any DNS names, or supply to any connecting users. All traffic which arrives at configured ports on a Filtered IP will be filtered for attack, and then forwarded to your configured backend server.
Note: Keep host and provider firewalls enabled. Allow the required service traffic from the current Backend Communication IP Addresses shown in the Dashboard. For tunnels, also allow the selected tunnel protocol between its endpoints.
Have fun Survivalists!
