Anti-DDOS settings in Linux

Modify sysctl Parameters
$ Sudo sysctl-a | grep ipv4 | grep syn

The output is similar to the following:

Net. ipv4.tcp _ max_syn_backlog = 1024
Net. ipv4.tcp _ syncookies = 0
Net. ipv4.tcp _ synack_retries = 5
Net. ipv4.tcp _ syn_retries = 5

 

Net. ipv4.tcp _ syncookies indicates whether to enable syn cookies. If "1" is enabled, "2" is disabled.
Net. ipv4.tcp _ max_syn_backlog is the length of the SYN queue. Increasing the queue length can accommodate more network connections waiting for connection.
Net. ipv4.tcp _ synack_retries and net. ipv4.tcp _ syn_retries define the number of SYN retries.

Add the following to/etc/sysctl. conf and then run "sysctl-p "!

Net. ipv4.tcp _ syncookies = 1
Net. ipv4.tcp _ max_syn_backlog = 4096
Net. ipv4.tcp _ synack_retries = 2
Net. ipv4.tcp _ syn_retries = 2

Improve TCP connection capability

Net. ipv4.tcp _ rmem = 32768
Net. ipv4.tcp _ wmem = 32768
Net. ipv4.sack = 0 # My Centos 5.4 prompt does not contain this keyword

Use iptables
Command:

# Netstat-an | grep ": 80" | grep ESTABLISHED

To check which IP addresses are suspicious ~ For example, the ip address 221.238.196.83 has many connections and is suspicious. It is not expected to be connected to 221.238.196.81 again. You can run the following command:

Iptables-a input-s 221.238.196.81-p tcp-d 221.238.196.83 -- dport 25 -- syn-j ACCEPT

This is wrong.

I think it should be written like this

Iptables-a input-s 221.238.196.83-p tcp-j DROP

 

Discard the package from 221.238.196.83.

Syn flood attacks that counterfeit source IP addresses. The method is invalid.

Other references

Sync Flood Prevention)

# Iptables-a forward-p tcp -- syn-m limit -- limit 1/s-j ACCEPT

Some people write

# Iptables-a input-p tcp -- syn-m limit -- limit 1/s-j ACCEPT

-- Limit 1/s limits the number of syn concurrent requests per second. You can modify the limit to prevent port scanning based on your needs.

# Iptables-a forward-p tcp -- tcp-flags SYN, ACK, FIN, RST-m limit -- limit 1/s-j ACCEPT

Ping flood attack (Ping of Death)

# Iptables-a forward-p icmp -- icmp-type echo-request-m limit -- limit 1/s-j ACCEPT

 

BSD

Run:

Sysctl net. inet. tcp. msl = 7500

To make the restart effective, add the following lines to/etc/sysctl. conf:

Net. inet. tcp. msl = 7500