Iptables limit the number of same IP connections in Linux anti-Cc/ddos attack method

1. Limit the number of IP connections to 80 ports to a maximum of 10, which can be customized.

The code is as follows	Copy Code
Iptables-i input-p TCP--dport 80-m connlimit--connlimit-above 10-j DROP

2. Use the recent module to limit the number of new requests in the same IP time, recent more features please refer to: Iptables Module recent application.

The code is as follows	Copy Code
Iptables-a input-p TCP--dport/--syn-m recent--name webpool--rcheck--seconds--hitcount 10-j LOG--log-prefix ' DDOS: '--log-ip-options #60秒10个新连接, the log is exceeded. Iptables-a input-p TCP--dport--syn-m recent--name webpool--rcheck--seconds--hitcount 10-j DROP #60秒10个新连接, the dropped packets are exceeded. Iptables-a input-p TCP--dport--syn-m recent--name webpool--set-j ACCEPT #范围内允许通过.

The above is relatively simple, let me analyze the more specific configuration method. Centos/redhat/fedora

On the server execution

The code is as follows

Copy Code

Vi/etc/sysconfig/iptables Delete the original content to save the contents as follows # Generated by Iptables-save v1.3.5 on Sun Dec 12 23:55:59 2010 *filter : INPUT DROP [385,263:27,864,079] : FORWARD ACCEPT [0:0] : OUTPUT ACCEPT [4,367,656:3,514,692,346] -A input-i lo-j ACCEPT -A input-m state–state related,established-j ACCEPT -A input-p icmp-j ACCEPT -A input-s 127.0.0.1-j ACCEPT -A input-p tcp-m tcp–dport 80-m state–state new-m recent–set–name Web–rsource -A input-p tcp-m tcp–dport 80-m state–state new-m recent–update–seconds 5–hitcount 20–rttl–name web–rsource-j DROP -A input-p tcp-m multiport–ports 21,22,80-j ACCEPT -A input-p tcp-m tcp–tcp-flags syn,rst,ack syn-m ttl–ttl-eq 117-j DROP -A input-p tcp-m tcp–tcp-flags syn,rst,ack syn-m length–length 0:40-j DROP -A input-p tcp-m TCP! –tcp-flags syn,rst,ack syn-m state–state new-j DROP COMMIT # completed on Sun Dec 12 23:55:59 2010

Note that this setting is open only to three TCP ports (FTP), (SSH), (HTTP website). Set 80 ports for 5 seconds with 20 connections

Www.111cn.net/sys/linux/51412.htm

Iptables limit the number of same IP connections in Linux anti-Cc/ddos attack method