Iptables anti-DDoS attacks and CC attack settings

Source: Internet
Author: User

Tags: wc-l lis accept dos targe customer href forward rop

Protect against DDoS attack scripts

#防止SYN攻击 Lightweight prevention

Iptables-n syn-flood iptables-a input-p tcp--syn-j syn-flood iptables-i syn-flood-p tcp-m limit--limit 3/s--limi T-burst 6-j RETURN iptables-a syn-flood-j REJECT

#防止DOS太多连接进来, you can allow up to 15 initial connections per IP for an external network card, over the discarded

Iptables-a input-i eth0-p tcp--syn-m connlimit--connlimit-above 15-j DROP iptables-a input-p tcp-m State--state Established,related-j ACCEPT

#用iptables against DDOS (parameters are the same as above)

Iptables-a INPUT-  p tcp--syn-m limit--limit 12/s--limit-burst 24-j acceptiptables-a forward-p TCP--syn-m Lim It--limit 1/s-j ACCEPT

##########################################################

Protect against CC attacks

When the Apache site is subjected to a severe cc attack, we can use Iptables to prevent the Web server from being attacked by CC, enabling the automatic blocking of IP capabilities.

1. System Requirements

(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, which is cumbersome, but can also be implemented).

(2) iptables version: 1.3.7

2. Installation

Install kernel modules for iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit

3. Configure the appropriate iptables rules

Examples are as follows:

(1) Maximum number of concurrent connections that control a single IP

Iptables-i input-p TCP--dport 80-m connlimit  --connlimit-above 50-j REJECT #允许单个IP的最大连接数为 30

#默认iptables模块不包含connlimit, you need to compile your own load separately, please refer to this address
http://sookk8.blog.51cto.com/455855/280372 do not compile kernel load connlimit module


(2) control the number of newly established connections in a single IP at a certain time (for example, 60 seconds)

Iptables-a input-p TCP--dport 80-m recent--name bad_http_access--update--seconds the--hitcount 30-j REJECT iptable S-a input-p TCP--dport 80-m recent--name bad_http_access--set-j ACCEPT

#单个IP在60秒内只允许最多新建30个连接

4. Verification

(1) Tool: flood_connect.c (used to simulate attack)

(2) View results:

Use
Watch ' Netstat-an | grep:21 | grep< impersonation Attack client's ip>| Wc-l '


Real-time view of the number of connections built up by simulated attack clients,

Use
Watch ' Iptables-l-n-v | \grep< impersonation Attack client's ip> '


View the number of packets that were killed by the simulated attack client.

5. Attention

To enhance iptables's ability to prevent CC attacks, it is best to adjust the ipt_recent parameters as follows:

#cat/etc/modprobe.conf options Ipt_recent ip_list_tot=1000 ip_pkt_list_tot=60
#记录1000个IP地址, each address records 60 packets #modprobe Ipt_recent

Iptables anti-DDoS attacks and CC attack settings

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

Tags Index: