# Examples

> Ready-made moat rulesets for Minecraft, Rust, CS2 and FiveM servers, SSH, WireGuard and web servers, one folder per DDoS attack vector, and iptables and nftables migrations.

Source: https://moatfw.dev/docs/examples

The [moat-examples](https://github.com/moatfw/moat-examples) repository
has rulesets for game servers, for running a host, for single attack
vectors and for migrating from iptables or nftables. Every folder has the
rules, a case file that shows what they do, and a README with what they
were measured to do in the kernel.

```sh
$ git clone https://github.com/moatfw/moat-examples
$ cd moat-examples/game/minecraft-java
$ moat check minecraft-java.moat
$ sudo moat test minecraft-java.moat minecraft-java.toml
```

Off Linux, or with `--model`, `moat test` runs the cases in
[moat's model of the program](https://moatfw.dev/docs/testing#without-a-kernel), without
root.

## Game servers

In `game/`. All of them are `default pass` and only touch the game's own
ports, so their rules can be pasted into one file with an `admin/`
ruleset for the rest of the host; an interface runs one program.

| Game | Folder | What it stops |
|------|--------|---------------|
| Minecraft Java | `game/minecraft-java` | Bot joins, ping floods, connection floods, legacy ping scanners, UDP floods; a login cap to switch on during an attack. |
| Minecraft Bedrock | `game/minecraft-bedrock` | Spoofed RakNet pings (amplification), session open floods, malformed RakNet, floods from one source. |
| Rust | `game/rust` | A2S query floods, junk on the query port, reflected answers, floods from one source; RCON for admins only. |
| CS2, Garry's Mod, TF2 and other Source games | `game/source-server` | Reflected answers, malformed UDP, A2S query floods, floods from one source; SSH for admins only. |
| FiveM | `game/fivem` | Sources that never send the FiveM handshake, player list scrapers. |

## Running a host

In `admin/`.

| Folder | What it does |
|--------|--------------|
| `admin/management-ports` | Admin panels, databases, Docker, exporters: reachable from the admin networks only. |
| `admin/ssh` | SSH open to the internet: password guessing limited, guessers banned for an hour. |
| `admin/wireguard` | Admin access only through WireGuard: handshake floods and malformed messages dropped, SSH closed on the public side. |
| `admin/icmp-policy` | Keeps path MTU discovery and neighbour discovery working, budgets pings and error floods, drops the rest. |
| `admin/blocklist` | Published blocklists and bans from scripts or fail2ban, with the admins always let in. |
| `admin/country-allowlist` | Game traffic only from the countries the players are in. |
| `admin/emergency-mode` | One `moat var set` turns the host into known players and admins only, and back. |
| `admin/web-server` | A complete default-drop ruleset for a web server. |

## One attack at a time

`ddos/` has ten folders, one per attack vector: SYN, ACK and RST floods,
bad TCP flags, UDP floods, UDP amplification, VSE queries, GRE,
fragments, spoofed sources and HTTP floods. Each has the rules, the
cases and a README with what the limit allows in throughput, the cost per
packet measured with `moat bench`, and its caveats, plus live results
from a loaded interface.

## Migrating

`migration/iptables` and `migration/nftables` walk through
[importing iptables](https://moatfw.dev/docs/import-iptables) and
[importing nftables](https://moatfw.dev/docs/import-nftables) rules, with the input, the
importer's output exactly as produced, and cases for the result. The
iptables one carries an ipset over with `--ipsets`.

## Before using one

> Per-source budgets assume one address is one client. Exempt reverse
> proxies, CDNs, load balancers and other addresses that put many users
> behind one source first. The figures are lab numbers from the kernel's
> test runner, not guarantees for a server under attack.

Exempting a list of proxies takes one rule placed before the others:

```moat
set proxies from "proxies.txt"
rule proxies { when ip.src in proxies then pass }
```

The addresses in the examples are documentation ranges: put your own
networks in `admins.txt` and the other set files. Load new rules with
`--audit` first and check `moat stats` before enforcing them:

```sh
$ sudo moat load minecraft-java.moat --iface eth0 --audit
$ sudo moat stats --iface eth0
$ sudo moat audit off --iface eth0
```