Iptables anti-DDoS attacks and CC attack settings

Source: Internet
Author: User

Protect against DDoS attack scripts

#防止SYN攻击 Lightweight prevention

Iptables-n syn--a input-p tcp--syn-j syn-36 --a syn-flood-j REJECT

#防止DOS太多连接进来, you can allow up to 15 initial connections per IP for an external network card, over the discarded

 --A input-p tcp-m State--state established,related-j ACCEPT

#用iptables against DDOS (parameters are the same as above)

Iptables-a INPUT   -1/s-j ACCEPT

Protect against CC attacks

When the Apache site is subjected to a severe cc attack, we can use Iptables to prevent the Web server from being attacked by CC, enabling the automatic blocking of IP capabilities.

1. System Requirements

(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, which is cumbersome, but can also be implemented).

(2) iptables version: 1.3.7

2. Installation

Install kernel modules for iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit

3. Configure the appropriate iptables rules

Examples are as follows:

(1) Maximum number of concurrent connections that control a single IP


#默认iptables模块不包含connlimit, you need to compile your own load separately, please refer to this address
http://sookk8.blog.51cto.com/455855/280372 do not compile kernel load connlimit module

(2) control the number of newly established connections in a single IP at a certain time (for example, 60 seconds)

 the  -  -  -M recent--name bad_http_access--set-J accept# single IP allows up to 30 new connections within 60 seconds

4. Verification

(1) Tool: flood_connect.c (used to simulate attack)

(2) View results:


' Netstat-an | grep:21 | grep< simulated attack client ip>| wc-l '

Real-time view of the number of connections built up by simulated attack clients,


' iptables-l-n-v | \grep< simulated attack client's ip> '

View the number of packets that were killed by the simulated attack client.

5. Attention

To enhance iptables's ability to prevent CC attacks, it is best to adjust the ipt_recent parameters as follows:

#Cat/etc/modprobeconf options ipt_recent ip_list_tot= 60 ip_pkt_list_tot=  #记录1000个IP地址, 60 packets per address record #modprobe ipt_recent

7 -J ACCEPT/ Indicates that the Litmit/minute limit is started when the total number of connections exceeds 100

Iptables anti-DDoS attacks and CC attack settings

Related Article

E-Commerce Solutions

Leverage the same tools powering the Alibaba Ecosystem

Learn more >

Apsara Conference 2019

The Rise of Data Intelligence, September 25th - 27th, Hangzhou, China

Learn more >

Alibaba Cloud Free Trial

Learn and experience the power of Alibaba Cloud with a free trial worth $300-1200 USD

Learn more >

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.