Automatically blocks DDOS attacks using SHELL scripts

A very practical iptables script that automatically rejects suspicious IP addresses and sends alarm emails and text messages
Linux :~ # Cat iptables
#! /Bin/bash
Touch/root/back_bad_ip.txt
Time = 'date + "% Y-% m-% d % H: % M: % S "'
Ar = 'wc-l/root/back_bad_ip.txt | awk '{print $1 }''
Sleep 1
# Replace the red color with ports and SYN_RECV.
Netstat-an | grep 80 | grep-v "STREAM" | awk '{print $5}' | sort | awk-F: '{print $1}' | uniq-c | awk '$1> 100 {print $1, $2}'>/root/bad_ip;
Cat bad_ip | awk-vtime = "$ time" '{print time "|" $1 "|" $2}'>/root/back_bad_ip.txt
Ar2 = 'wc-l/root/back_bad_ip.txt | awk '{print $1 }''
For I in 'awk' {print $2} '/root/bad_ip'
Do
Iptables-I input-s $ I-j DROP
Done
I1 = 'echo "$ ar2-$ ar" | bc'
Tail0 = 'Tail-n $ i1/root/back_bad_ip.txt'
For i2 in 'echo "$ ar2-$ ar" | bc'
Do
If ([$ i2-gt 0] & [$ i2-lt 5]); then
Sendmail-t <EOF
From: monitor@zhaoyun.com
To: 15101507336@139.com
Subject: warning
$ Time your system may be attacked. Please respond as soon as possible. There is currently $ i1 attack source IP address, which has been intercepted by the system.
$ Tail0
EOF
Fi
Done
Tail5 = 'Tail-n $ i1/root/back_bad_ip.txt'
For i2 in 'echo "$ ar2-$ ar" | bc'
Do
If [$ i2-gt 5]; then
Sendmail-t <EOF
From: monitor@zhaoyun.com
To: 15101507336@139.com
Subject: Serious warning
$ Time your system is under attack. Please respond as soon as possible. There is currently $ i1 attack source IP address, which has been intercepted by the system.
$ Tail5
EOF
Fi
Done


The shell won't be used, but this script must be easy to use.
You can view the connection record in back_bad_ip.txt to make it traceable.
Linux :~ # Cat back_bad_ip.txt

Number of times the connection was established IP Address
08:59:37 | 127 | 118.144.78.36
08:59:37 | 211 | 118.144.78.37
08:59:37 | 115 | 118.144.78.38
08:59:37 | 113 | 118.144.78.42

Run the script in the background.
Linux :~ #/Root/10_seconds &


Linux :~ # Cat 10_seconds
#! /Bin/bash
While [1]
Do
/Root/iptables
Sleep 10
Done



It executes the/root/iptables script every 10 seconds.
Effect of email receipt
650) this. width = 650; "src =" ../attachment/201107/084337868 .jpg" alt = "" border = "0"/>
Effective only when attacked
This disadvantage is that if an attack is executed once every 10 seconds, many repeated rules will be added to the IPTABLES rule. We recommend that you keep fixed rules in the configuration file. Restart the iptables service once to clear automatically added rules. The original rules are not affected.

This article is from the "Technical Exchange" blog, please be sure to keep this source http://zhaoyun.blog.51cto.com/2090116/606878