Use iptables to mitigate and prevent DDoS and CC attacks

An example of iptables anti-DDoS method

Mitigating DDoS attacks
#防止SYN攻击, lightweight prevention

Iptables-n Syn-flood
Iptables-a input-p tcp–syn-j Syn-flood
Iptables-i syn-flood-p tcp-m limit–limit 3/s–limit-burst 6-j return
Iptables-a syn-flood-j REJECT

#防止DOS太多连接进来, you can allow the external network card to each IP up to 15 initial connections, over the discarded

Iptables-a input-i eth0-p tcp–syn-m connlimit–connlimit-above 15-j DROP
Iptables-a input-p tcp-m state–state established,related-j ACCEPT

#用Iptables缓解DDOS (same argument as above)

Iptables-a input-p tcp–syn-m limit–limit 12/s–limit-burst 24-j
Iptables-a forward-p tcp–syn-m limit–limit 1/s-j

Mitigating CC attacks
When the Apache site is hit by a serious cc attack, we can use Iptables to prevent the Web server from being cc-attacked and automatically masking attack IPs.

1. System Requirements
(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, more cumbersome, but also achievable).
(2) iptables version: 1.3.7

2. Installation
Install the kernel modules corresponding to the iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit

3. Configure the corresponding iptables rules

Examples are as follows:

(1) Control the maximum number of concurrent connections for a single IP

Iptables-i input-p tcp–dport 80-m connlimit–connlimit-above 25-j REJECT #允许单个IP的最大连接数为25个

#早期iptables模块不包含connlimit, you need to compile the load yourself, refer to the address http://sookk8.blog.51cto.com/455855/280372 do not compile the kernel load connlimit module

(2) control the number of new connections allowed for a single IP at a certain time (such as 60 seconds)

Iptables-a input-p tcp–dport 80-m recent–name bad_http_access–update–seconds 60–hitcount 30-j REJECT
Iptables-a input-p tcp–dport 80-m recent–name bad_http_access–set-j

#单个IP在60秒内只允许最多新建30个连接

Real-time view of the number of connections established by the simulated attack client

Watch ' Netstat-an | grep:21 | grep < attack ip>| Wc-l

To view the number of packets that simulate an attack client being DROP

Watch ' Iptables-l-n-v | grep < attack ip>