Use iptables to mitigate and prevent DDoS and CC attacks

Source: Internet
Author: User
Tags versions iptables

An example of iptables anti-DDoS method

Mitigating DDoS attacks
#防止SYN攻击, lightweight prevention

Iptables-n Syn-flood
Iptables-a input-p tcp–syn-j Syn-flood
Iptables-i syn-flood-p tcp-m limit–limit 3/s–limit-burst 6-j return
Iptables-a syn-flood-j REJECT

#防止DOS太多连接进来, you can allow the external network card to each IP up to 15 initial connections, over the discarded

Iptables-a input-i eth0-p tcp–syn-m connlimit–connlimit-above 15-j DROP
Iptables-a input-p tcp-m state–state established,related-j ACCEPT

#用Iptables缓解DDOS (same argument as above)

Iptables-a input-p tcp–syn-m limit–limit 12/s–limit-burst 24-j
Iptables-a forward-p tcp–syn-m limit–limit 1/s-j

Mitigating CC attacks
When the Apache site is hit by a serious cc attack, we can use Iptables to prevent the Web server from being cc-attacked and automatically masking attack IPs.

1. System Requirements
(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, more cumbersome, but also achievable).
(2) iptables version: 1.3.7

2. Installation
Install the kernel modules corresponding to the iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit

3. Configure the corresponding iptables rules

Examples are as follows:

(1) Control the maximum number of concurrent connections for a single IP

Iptables-i input-p tcp–dport 80-m connlimit–connlimit-above 25-j REJECT #允许单个IP的最大连接数为25个

#早期iptables模块不包含connlimit, you need to compile the load yourself, refer to the address http://sookk8.blog.51cto.com/455855/280372 do not compile the kernel load connlimit module

(2) control the number of new connections allowed for a single IP at a certain time (such as 60 seconds)

Iptables-a input-p tcp–dport 80-m recent–name bad_http_access–update–seconds 60–hitcount 30-j REJECT
Iptables-a input-p tcp–dport 80-m recent–name bad_http_access–set-j

#单个IP在60秒内只允许最多新建30个连接

Real-time view of the number of connections established by the simulated attack client

Watch ' Netstat-an | grep:21 | grep < attack ip>| Wc-l

To view the number of packets that simulate an attack client being DROP

Watch ' Iptables-l-n-v | grep < attack ip>

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.