Protect against DDoS attack scripts
#防止SYN攻击 Lightweight prevention
Iptables-n syn--a input-p tcp--syn-j syn-36 --a syn-flood-j REJECT
#防止DOS太多连接进来, you can allow up to 15 initial connections per IP for an external network card, over the discarded
--A input-p tcp-m State--state established,related-j ACCEPT
#用iptables against DDOS (parameters are the same as above)
Iptables-a INPUT -1/s-j ACCEPT
Protect against CC attacks
When the Apache site is subjected to a severe cc attack, we can use Iptables to prevent the Web server from being attacked by CC, enabling the automatic blocking of IP capabilities.
1. System Requirements
(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, which is cumbersome, but can also be implemented).
(2) iptables version: 1.3.7
Install kernel modules for iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit
3. Configure the appropriate iptables rules
Examples are as follows:
(1) Maximum number of concurrent connections that control a single IP
#默认iptables模块不包含connlimit, you need to compile your own load separately, please refer to this address
http://sookk8.blog.51cto.com/455855/280372 do not compile kernel load connlimit module
(2) control the number of newly established connections in a single IP at a certain time (for example, 60 seconds)
the - - -M recent--name bad_http_access--set-J accept# single IP allows up to 30 new connections within 60 seconds
(1) Tool: flood_connect.c (used to simulate attack)
(2) View results:
' Netstat-an | grep:21 | grep< simulated attack client ip>| wc-l '
Real-time view of the number of connections built up by simulated attack clients,
' iptables-l-n-v | \grep< simulated attack client's ip> '
View the number of packets that were killed by the simulated attack client.
To enhance iptables's ability to prevent CC attacks, it is best to adjust the ipt_recent parameters as follows:
#Cat/etc/modprobeconf options ipt_recent ip_list_tot= 60 ip_pkt_list_tot= #记录1000个IP地址, 60 packets per address record #modprobe ipt_recent
7 -J ACCEPT/ Indicates that the Litmit/minute limit is started when the total number of connections exceeds 100
Iptables anti-DDoS attacks and CC attack settings