Use iptables to prevent CC attacks on web Servers

Source: Internet
Author: User

When the apache site is under severe cc attacks, we can use iptables to prevent CC attacks on the web server and automatically shield the IP address.

1. System Requirements

(1) LINUX kernel version: 2.6.9-42ELsmp or 2.6.9-55 ELsmp (Other kernel versions need to re-compile the kernel, Which is troublesome, but can also be implemented ).
(2) iptables version: 1.3.7

2. Installation

Install the kernel module kernel-smp-modules-connlimit corresponding to iptables1.3.7 and the system kernel version

3. Configure the corresponding iptables rules

Example:
(1) control the maximum number of concurrent connections of a single IP Address

Iptables-I INPUT-p tcp-dport 80-m connlimit
-Connlimit-above 50-j REJECT
# The maximum number of connections allowed for a single IP address is 30

(2) control the number of new connections allowed by a single IP address within a certain period of time (such as 60 seconds)

Iptables-a input-p tcp-dport 80-m recent
-Name BAD_HTTP_ACCESS-update-seconds 60
-Hitcount 30-j REJECT
Iptables-a input-p tcp-dport 80-m recent
-Name BAD_HTTP_ACCESS-set-j ACCEPT
# Up to 30 connections can be created for a single IP address within 60 seconds

4. Verify

(1) tool: flood_connect.c (used to simulate attacks)
(2) view results:
Use

Watch 'netstat-an | grep: 21 | grep <IP address of the simulated attack client> | wc-l'

View the number of connections established by the simulated attack client in real time,

Use

Watch 'iptables-L-n-v | grep <IP address of the simulated attacker>'

View the number of dropped packets of a simulated attack client.
5. Note
To enhance iptables's ability to prevent CC attacks, you 'd better adjust the ipt_recent parameter as follows:

# Cat/etc/modprobe. conf
Options ipt_recent ip_list_tot = 1000 ip_pkt_list_tot = 60
# Record 1000 IP addresses, each of which records 60 packets
# Modprobe ipt_recent

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.