How to Set up a Linux system firewall

Network is becoming more and more popular, and network attacks are also increasing. How can we better defend against network attacks? A thorough solution is to add a hardware firewall. However, hardware firewalls are expensive. You can consider using the firewall function of the Linux system to defend against attacks. Next we will teach you how to set up a Linux system firewall.

1. resist SYN

SYN attacks use the three-way handshake principle of the TCP/IP protocol to send a large number of network packets that establish connections, but do not actually establish connections. As a result, the network queue of the attacked server is full, cannot be accessed by normal users.

The Linux Kernel provides several SYN-related configurations. Run the following command:
Sysctl-a | grep syn

See:

 
 

  
  
net.ipv4.tcp_max_syn_backlog = 1024 
  
  
net.ipv4.tcp_syncookies = 0 
  
  
net.ipv4.tcp_synack_retries = 5 
  
  
net.ipv4.tcp_syn_retries = 5 
 
 

Tcp_max_syn_backlog is the length of the SYN queue, and tcp_syncookies are a function. Whether to enable the SYN Cookie function can prevent some SYN attacks. Tcp_synack_retries and tcp_syn_retries define the number of retries of SYN.

Increasing the SYN queue length can accommodate more network connections waiting for connection. Enabling the SYN Cookie function can prevent some SYN attacks and reduce the number of retries.

To adjust the preceding settings, follow these steps:

Increase the SYN queue length to 2048:
Sysctl-w net. ipv4.tcp _ max_syn_backlog = 2048

Enable the syn cookie function:
Sysctl-w net. ipv4.tcp _ syncookies = 1

Reduce the number of retries:

 
 

  
  
sysctl -w net.ipv4.tcp_synack_retries=3 
  
  
sysctl -w net.ipv4.tcp_syn_retries=3 
 
 

To maintain the preceding configuration during system restart, you can add the preceding command to the/etc/rc. d/rc. local file.

2. Resist DDOS attacks

DDOS and distributed denial of access (DDOS) attacks mean that hackers send a large number of connections to common ports, such as 80 and 25, to many hosts from different sources. However, these clients only establish connections, not normal access. Generally, because the number of accepted connections configured by Apache is limited to 256), these "fake" access will fill up Apache and normal access will fail.

Linux provides a firewall tool called ipchains to shield connections from specific IP addresses or IP address segments to specific ports. To use ipchains to defend against DDOS attacks, you must first use the netstat command to find the source address of the attack, and then use the ipchains command to block the attack. One block is found.

* ** Enable the ipchains Function

First, check whether the ipchains service is set to auto start:
Chkconfig -- list ipchains

The output is generally:
Ipchains 0: off 1: off 2: on 3: on 4: on 5: on 6: off

If the column 345 is on, the ipchains service has been set to auto start.

If not, run the following command:
Chkconfig -- add ipchains

Set ipchains to auto start

Next, check whether the ipchains configuration file/etc/sysconfig/ipchains exists. If this file does not exist, ipchains

It does not take effect even if it is set to automatic start. The default ipchains configuration file is as follows:

 
 

  
  
# Firewall configuration written by lokkit  
  
  
# Manual customization of this file is not recommended.  
  
  
# Note: ifup-post will punch the current nameservers through the  
  
  
# firewall; such entries will *not* be listed here.  
  
  
:input ACCEPT  
  
  
:forward ACCEPT  
  
  
:output ACCEPT  
  
  
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT  
  
  
# allow http,ftp,smtp,ssh,domain via tcp; domain via udp  
  
  
-A input -p tcp -s 0/0 -d 0/0 pop3 -y -j ACCEPT  
  
  
-A input -p tcp -s 0/0 -d 0/0 http -y -j ACCEPT  
  
  
-A input -p tcp -s 0/0 -d 0/0 https -y -j ACCEPT  
  
  
-A input -p tcp -s 0/0 -d 0/0 ftp -y -j ACCEPT  
  
  
-A input -p tcp -s 0/0 -d 0/0 smtp -y -j ACCEPT  
  
  
-A input -p tcp -s 0/0 -d 0/0 ssh -y -j ACCEPT  
  
  
-A input -p tcp -s 0/0 -d 0/0 domain -y -j ACCEPT  
  
  
-A input -p udp -s 0/0 -d 0/0 domain -j ACCEPT  
  
  
# deny icmp packet  
  
  
#-A input -p icmp -s 0/0 -d 0/0 -j DENY  
  
  
# default rules  
  
  
-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT  
  
  
-A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT  
  
  
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT  
  
  
-A input -p udp -s 0/0 -d 0/0 2049 -j REJECT  
  
  
-A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT  
  
  
-A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT 
 
 

If the/etc/sysconfig/ipchains file does not exist, you can use the above content to create it. After creation, start ipchains Server:

/Etc/init. d/ipchains start

* ** Use the netstat command to find the attack source

If the hacker attacks port 80 on the Web, view the IP address and port of the Client Connected to port 80. The command is as follows:

Netstat-an-t tcp | grep ": 80" | grep ESTABLISHED | awk {printf "% s \ n", $5, $6} | sort

Output:

 
 

  
  
161.2.8.9:123 FIN_WAIT2  
  
  
161.2.8.9:124 FIN_WAIT2  
  
  
61.233.85.253:23656 FIN_WAIT2  
  
  
… 
 
 

The first column is the Client IP address and port, and the second column is the connection status.

If there are more than 50 connections from the same IP address and they are all continuous ports, it is likely to be an attack.

If you only want to view the established connection, run the following command:
Netstat-an-t tcp | grep ": 80" | grep ESTABLISHED | awk {printf "% s \ n", $5, $6} | sort

In this way, you have completed the configuration of the Linux system firewall. I hope this article will help you.

1. How to configure an Open Suse Linux Server
2. Comprehensive Analysis of Suse Linux passed the sun Test
3. Preschool guidance: SUSE Linux
4. Follow the summer project of Open Suse and Google Programming
5. Describe how to install Jdk and mysql in Open SUSE