Iptables anti-DDoS and CC attack settings

Anti-DDoS script

# Lightweight prevention against SYN Attacks
Iptables-N syn-flood
Iptables-A input-p tcp-syn-J syn-flood
Iptables-I syn-flood-P TCP-m limit-limit 3/s-limit-burst 6-J return
Iptables-a syn-flood-J reject

# Prevent too many Dos connections. You can allow up to 15 Initial connections from each IP address of the Internet Nic, exceeding the limit of discarding
Iptables-A input-I eth0-P TCP-syn-M connlimit-abve 15-J Drop
Iptables-A input-p tcp-M State-State established, related-J accept

# Use iptables to defend against DDoS attacks (the parameters are the same as those above)
Iptables-A input-p tcp -- syn-m limit -- limit 12/s -- limit-burst 24-J accept
Iptables-a forward-p tcp -- syn-m limit -- limit 1/S-J accept

######################################## ##################

Prevent CC attacks

When the Apache site is under severe CC attacks, we can use iptables to prevent CC attacks on the Web server and automatically shield the IP address.

1. System Requirements

(1) Linux kernel version: 2.6.9-42elsmp or 2.6.9-55 elsmp (Other kernel versions need to re-compile the kernel, Which is troublesome, but can also be implemented ).

(2) iptables version: 1.3.7

2. Installation

Install the kernel module kernel-smp-modules-connlimit corresponding to iptables1.3.7 and the system kernel version

3. Configure the corresponding iptables rules

Example:

(1) control the maximum number of concurrent connections of a single IP Address

Iptables-I input-P TCP -- dport 80-M connlimit -- connlimit-above 50-J reject # the maximum number of connections allowed for a single IP address is 30
# By default, the iptables module does not contain connlimit and must be compiled and loaded independently. For details, refer to this address.
Http://sookk8.blog.51cto.com/455855/280372 does not compile the kernel to load the connlimit Module

(2) control the number of new connections allowed by a single IP address within a certain period of time (such as 60 seconds)

Iptables-A input-p tcp -- dport 80-M recent -- name bad_http_access -- update -- seconds 60 -- hitcount 30-J reject iptables-A input-p tcp -- dport 80-M recent -- name bad_http_access -- Set-J accept
# Up to 30 connections can be created for a single IP address within 60 seconds

4. Verify

(1) tool: flood_connect.c (used to simulate attacks)

(2) view results:

Use
Watch 'netstat-an | grep: 21 | grep <IP address of the simulated attack client> | WC-l'

View the number of connections established by the simulated attack client in real time,

Use
Watch 'iptables-l-N-v | \ grep <IP address of the simulated attack client>'

View the number of dropped packets of a simulated attack client.

5. Note

To enhance iptables's ability to prevent CC attacks, you 'd better adjust the ipt_recent parameter as follows:

# Cat/etc/modprobe. conf options ipt_recent ip_list_tot = 1000 ip_pkt_list_tot = 60
# Record 1000 IP addresses and 60 data packets per address # modprobe ipt_recent

This article is from the "Linux advanced house" blog and will not be reposted!