Use iptables to prevent CC attacks on web Servers

When the apache site is under severe cc attacks, we can use iptables to prevent CC attacks on the web server and automatically shield the IP address.

1. System Requirements

(1) LINUX kernel version: 2.6.9-42ELsmp or 2.6.9-55 ELsmp (Other kernel versions need to re-compile the kernel, Which is troublesome, but can also be implemented ).
(2) iptables version: 1.3.7

2. Installation

Install the kernel module kernel-smp-modules-connlimit corresponding to iptables1.3.7 and the system kernel version

3. Configure the corresponding iptables rules

Example:
(1) control the maximum number of concurrent connections of a single IP Address

Iptables-I INPUT-p tcp-dport 80-m connlimit
-Connlimit-above 50-j REJECT
# The maximum number of connections allowed for a single IP address is 30

(2) control the number of new connections allowed by a single IP address within a certain period of time (such as 60 seconds)

Iptables-a input-p tcp-dport 80-m recent
-Name BAD_HTTP_ACCESS-update-seconds 60
-Hitcount 30-j REJECT
Iptables-a input-p tcp-dport 80-m recent
-Name BAD_HTTP_ACCESS-set-j ACCEPT
# Up to 30 connections can be created for a single IP address within 60 seconds

4. Verify

(1) tool: flood_connect.c (used to simulate attacks)
(2) view results:
Use

Watch 'netstat-an | grep: 21 | grep <IP address of the simulated attack client> | wc-l'

View the number of connections established by the simulated attack client in real time,

Use

Watch 'iptables-L-n-v | grep <IP address of the simulated attacker>'

View the number of dropped packets of a simulated attack client.
5. Note
To enhance iptables's ability to prevent CC attacks, you 'd better adjust the ipt_recent parameter as follows:

# Cat/etc/modprobe. conf
Options ipt_recent ip_list_tot = 1000 ip_pkt_list_tot = 60
# Record 1000 IP addresses, each of which records 60 packets
# Modprobe ipt_recent