Lightweight applets that reduce DDoS attacks

DDoS deflate is a free script for defending against and mitigating DDoS attacks. It uses netstat to monitor and track the IP addresses that create a large number of network connections. When detecting that a node exceeds the preset limitProgramThese IP addresses are prohibited or blocked through the filters or iptables.
Official Website: http://deflate.medialayer.com/

1. Install DDoS deflate
Shell> wget http://www.inetbase.com/scripts/ddos/install.sh
Shell> chmod 0700 install. Sh
Shell>./install. Sh

2. Configure DDoS deflate
The default configuration of DDoS deflate is/usr/local/DDOS/DDoS. conf. The content is as follows:
##### Paths of the script and other files
Progdir = "/usr/local/DDOS"
Prog = "/usr/local/DDOS/DDoS. Sh"
Ignore_ip_list = "/usr/local/DDOS/ignore. IP. List" // ip address whitelist
Cron = "/etc/cron. d/DDoS. cron" // scheduled execution Program
<G id = "1"> </etc/</G>"
EPT = "/sbin/iptables"
##### Frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with -- Cron
##### Option so that the new frequency takes effect
Freq = 1 // check interval. The default value is 1 minute.
##### How many connections define a bad Ip? Indicate that below.
No_of_connections = 150 // The maximum number of connections. IP addresses exceeding this value will be blocked. Generally, the default value is enough.
##### Apf_ban = 1 (make sure your APL version is atleast 0.96)
##### Apf_ban = 0 (uses iptables for banning IPS instead of APT)
Apf_ban = 1 // whether to use the public IP address whitelist or iptables. We recommend that you use iptables to change the value of apf_ban to 0.
##### Kill = 0 (Bad IPs are 'nt banned, good for interactive execution of script)
##### Kill = 1 (recommended setting)
Kill = 1 // whether the IP address is blocked. The default value is enough.
##### An email is sent to the following address when an IP is banned.
##### Blank wocould suppress sending of mails
Email_to = "root" // when the IP address is blocked, send an email to the specified email address. We recommend that you use it in your own email address.
##### Number of seconds the banned IP shoshould remain in blacklist.
Ban_period = 600 // ip address disabling time. The default value is 600 seconds. It can be adjusted as needed.

3. Uninstall DDoS deflate
Shell> wget http://www.inetbase.com/scripts/ddos/uninstall.ddos
Shell> chmod 0700 Uninstall. DDoS
Shell>./uninstall. DDoS

4. whitelist settings
Sometimes there are frequent mistakes in the default whitelist. To avoid this problem, we can manually set the IP address of the whitelist and force it not to be modified.
VI/usr/local/DDOS/ignore. IP. List // manually set the whitelist IP Address
Chattr + I/usr/local/DDOS/ignore. IP. List // force modification not allowed
Chattr-I/usr/local/DDOS/ignore. IP. List // undo not allow modification