Iptables Ping and DDoS to outsource script summary

The main 2 basic practical applications, mainly related to the ban Ping (IPv4) and the prohibition of UDP, that is, the use of the server to prevent hackers to outsource DDoS attack content.

First, if there is no iptables prohibit ping

echo 1 >/proc/sys/net/ipv4/icmp_echo_igore_all #开启
echo 0 >/proc/sys/net/ipv4/icmp_echo_igore_all #关闭
Second, the use of iptables rules to ban ping

Iptables-a input-p ICMP--icmp-type 8-s 0/0-j DROP

Third, using the Iptables rule, prohibit the server to outsource, prevent DDoS attack

Iptables-i output-p UDP--dport 53-d 8.8.8.8-j ACCEPT #允许UDP服务IP
Iptables-a output-p udp-j DROP #禁止udp服务

These 53 ports and 8888 are required by the DNS service, and if you do not know the DNS settings for this computer, you can execute the following command to obtain IP:

Cat/etc/resolv.conf

A nice firewall code.
#####################################################

-A input-f-m limit--limit 100/sec--limit-burst 100-j ACCEPT

-A input-p tcp-m tcp--tcp-flags syn,rst,ack syn-m limit--limit 20/sec--limit-burst 200-j

ACCEPT

-A input-p udp-m UDP--dport 138-j DROP

-A input-p udp-m UDP--dport 137-j DROP

-A input-p tcp-m tcp--dport 1068-j DROP

-A input-p icmp-m limit--limit 12/min--limit-burst 2-j DROP

-A forward-f-m limit--limit 100/sec--limit-burst 100-j ACCEPT

-A forward-p tcp-m tcp--tcp-flags syn,rst,ack syn-m limit--limit 20/sec--limit-burst 200

-j ACCEPT

-A forward-p tcp-m tcp--dport 445-j DROP

-A forward-p udp-m UDP--dport 138-j DROP

-A forward-p udp-m UDP--dport 137-j DROP

-A forward-p tcp-m tcp--dport 1068-j DROP

-A forward-p tcp-m tcp--dport 5554-j DROP

-A forward-p icmp-j DROP

:P rerouting ACCEPT [986,908:53,126,959]

:P ostrouting ACCEPT [31,401:2,008,714]

: OUTPUT ACCEPT [30,070:1,952,143]

-A postrouting-p tcp-m tcp--dport 445-j DROP

#####################################################

Iptables Firewall Example

#!/bin/bash
#
# The interface that connect Internet

# echo
echo "Enable IP forwarding ..."
Echo 1 >/proc/sys/net/ipv4/ip_forward
echo "Starting iptables rules ..."

Iface= "Eth0"

# include module
Modprobe Ip_tables
Modprobe Iptable_nat
Modprobe ip_nat_ftp
Modprobe Ip_nat_irc
Modprobe Ip_conntrack
Modprobe ip_conntrack_ftp
Modprobe Ip_conntrack_irc
Modprobe Ipt_masquerade

# init
/sbin/iptables-f
/sbin/iptables-x
/sbin/iptables-z
/sbin/iptables-f-T NAT
/sbin/iptables-x-T NAT
/sbin/iptables-z-T NAT

/sbin/iptables-x-T Mangle

# drop All
/sbin/iptables-p INPUT DROP
/sbin/iptables-p FORWARD ACCEPT
/sbin/iptables-p OUTPUT ACCEPT
/sbin/iptables-t nat-p prerouting ACCEPT
/sbin/iptables-t nat-p postrouting ACCEPT
/sbin/iptables-t nat-p OUTPUT ACCEPT

/sbin/iptables-a input-f-M limit--limit 100/sec--limit-burst 100-j ACCEPT
/sbin/iptables-a input-p tcp-m tcp--tcp-flags syn,rst,ack syn-m limit--limit 20/sec--limit-burst 200-j ACCEPT

/sbin/iptables-a input-p icmp-m limit--limit 12/min--limit-burst 2-j DROP

/sbin/iptables-a forward-f-M limit--limit 100/sec--limit-burst 100-j ACCEPT
/sbin/iptables-a forward-p tcp-m tcp--tcp-flags syn,rst,ack syn-m limit--limit 20/sec--limit-burst 200-j ACCEPT

# Open Ports
/sbin/iptables-a input-i $IFACE-P TCP--dport 21-j ACCEPT
/sbin/iptables-a input-i $IFACE-P TCP--dport 22-j ACCEPT
/sbin/iptables-a input-i $IFACE-P TCP--dport 25-j ACCEPT
/sbin/iptables-a input-i $IFACE-P TCP--dport 53-j ACCEPT
/sbin/iptables-a input-i $IFACE-p UDP--dport 53-j ACCEPT
/sbin/iptables-a input-i $IFACE-P TCP--dport 80-j ACCEPT
/sbin/iptables-a input-i $IFACE-P TCP--dport 100-j ACCEPT
/sbin/iptables-a input-i $IFACE-P TCP--dport 113-j ACCEPT

# Close Ports
Iptables-i input-p UDP--dport 69-j DROP
Iptables-i input-p TCP--dport 135-j DROP
Iptables-i input-p UDP--dport 135-j DROP
Iptables-i input-p TCP--dport 136-j DROP
Iptables-i input-p UDP--dport 136-j DROP
Iptables-i input-p TCP--dport 137-j DROP
Iptables-i input-p UDP--dport 137-j DROP
Iptables-i input-p TCP--dport 138-j DROP
Iptables-i input-p UDP--dport 138-j DROP
Iptables-i input-p TCP--dport 139-j DROP
Iptables-i input-p UDP--dport 139-j DROP
Iptables-i input-p TCP--dport 445-j DROP
Iptables-i input-p UDP--dport 445-j DROP
Iptables-i input-p TCP--dport 593-j DROP
Iptables-i input-p UDP--dport 593-j DROP
Iptables-i input-p TCP--dport 1068-j DROP
Iptables-i input-p UDP--dport 1068-j DROP
Iptables-i input-p TCP--dport 4444-j DROP
Iptables-i input-p UDP--dport 4444-j DROP
Iptables-i input-p TCP--dport 5554-j DROP
Iptables-i input-p TCP--dport 1434-j DROP
Iptables-i input-p UDP--dport 1434-j DROP
Iptables-i input-p TCP--dport 2500-j DROP
Iptables-i input-p TCP--dport 5800-j DROP
Iptables-i input-p TCP--dport 5900-j DROP
Iptables-i input-p TCP--dport 6346-j DROP
Iptables-i input-p TCP--dport 6667-j DROP
Iptables-i input-p TCP--dport 9393-j DROP

Iptables-i forward-p UDP--dport 69-j DROP
Iptables-i forward-p TCP--dport 135-j DROP
Iptables-i forward-p UDP--dport 135-j DROP
Iptables-i forward-p TCP--dport 136-j DROP
Iptables-i forward-p UDP--dport 136-j DROP
Iptables-i forward-p TCP--dport 137-j DROP
Iptables-i forward-p UDP--dport 137-j DROP
Iptables-i forward-p TCP--dport 138-j DROP
Iptables-i forward-p UDP--dport 138-j DROP
Iptables-i forward-p TCP--dport 139-j DROP
Iptables-i forward-p UDP--dport 139-j DROP
Iptables-i forward-p TCP--dport 445-j DROP
Iptables-i forward-p UDP--dport 445-j DROP
Iptables-i forward-p TCP--dport 593-j DROP
Iptables-i forward-p UDP--dport 593-j DROP
Iptables-i forward-p TCP--dport 1068-j DROP
Iptables-i forward-p UDP--dport 1068-j DROP
Iptables-i forward-p TCP--dport 4444-j DROP
Iptables-i forward-p UDP--dport 4444-j DROP
Iptables-i forward-p TCP--dport 5554-j DROP
Iptables-i forward-p TCP--dport 1434-j DROP
Iptables-i forward-p UDP--dport 1434-j DROP
Iptables-i forward-p TCP--dport 2500-j DROP
Iptables-i forward-p TCP--dport 5800-j DROP
Iptables-i forward-p TCP--dport 5900-j DROP
Iptables-i forward-p TCP--dport 6346-j DROP
Iptables-i forward-p TCP--dport 6667-j DROP
Iptables-i forward-p TCP--dport 9393-j DROP

/sbin/iptables-a input-i $IFACE-M state--state Related,established-j ACCEPT
/sbin/iptables-a input-i $IFACE-M state--state New,invalid-j DROP

# Drop Ping
/sbin/iptables-a input-p icmp-j DROP

/sbin/iptables-i input-s 222.182.40.241-j DROP