Iptables anti-DDoS attacks and CC attack settings

Protect against DDoS attack scripts

#防止SYN攻击 Lightweight prevention

iptables -N syn-flood 
iptables -A INPUT -p tcp --syn -j syn-flood 
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN 
iptables -A syn-flood -j REJECT

#防止DOS太多连接进来, you can allow up to 15 initial connections per IP for an external network card, over the discarded

iptables -A INPUT -i eth0 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP 
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

#用iptables against DDOS (parameters are the same as above)

iptables -A INPUT  -p tcp --syn -m limit --limit 12/s --limit-burst 24 -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

##########################################################

Protect against CC attacks

When the Apache site is subjected to a severe cc attack, we can use Iptables to prevent the Web server from being attacked by CC, enabling the automatic blocking of IP capabilities.

1. System Requirements

(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, which is cumbersome, but can also be implemented).

(2) iptables version: 1.3.7

2. Installation

Install kernel modules for iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit

3. Configure the appropriate iptables rules

Examples are as follows:

(1) Maximum number of concurrent connections that control a single IP

Iptables-i input-p TCP--dport 80-m connlimit --connlimit-above 50-j REJECT
#Maximum number of connections allowed for a single IP is 30

#默认iptables模块不包含connlimit, you need to compile your own load separately, please refer to this address
http://sookk8.blog.51cto.com/455855/280372 do not compile kernel load connlimit module

(2) control the number of newly established connections in a single IP at a certain time (for example, 60 seconds)

iptables -A INPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --update --seconds 60 --hitcount 30 -j REJECT 

iptables -A INPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --set -j ACCEPT

#A single IP only allows up to 30 new connections in 60 seconds

4. Verification

(1) Tool: flood_connect.c (used to simulate attack)

(2) View results:

Use
Watch ' Netstat-an | grep:21 | grep< impersonation Attack client's ip>| Wc-l '

Real-time view of the number of connections built up by simulated attack clients,

Use
Watch ' Iptables-l-n-v | \grep< impersonation Attack client's ip> '

View the number of packets that were killed by the simulated attack client.

5. Attention

To enhance iptables's ability to prevent CC attacks, it is best to adjust the ipt_recent parameters as follows:

#cat/etc/modprobe.conf options Ipt_recent ip_list_tot=1000 ip_pkt_list_tot=60
#Record 1000 IP addresses, each address records 60 packets #modprobe Ipt_recent

Iptables anti-DDoS attacks and CC attack settings