Linux uses iptables to mitigate DDoS and CC attacks

Mitigating DDoS attacks
#防止SYN攻击, lightweight prevention
Iptables-n Syn-flood
Iptables-a input-p tcp–syn-j Syn-flood
Iptables-i syn-flood-p tcp-m limit–limit 3/s–limit-burst 6-j return
Iptables-a syn-flood-j REJECT

#防止DOS太多连接进来, you can allow the external network card to each IP up to 15 initial connections, over the discarded
Iptables-a input-i eth0-p tcp–syn-m connlimit–connlimit-above 15-j DROP
Iptables-a input-p tcp-m state–state established,related-j ACCEPT

#用Iptables缓解DDOS (same argument as above)
Iptables-a input-p tcp--syn-m limit--limit 12/s--limit-burst 24-j ACCEPT
Iptables-a forward-p tcp--syn-m limit--limit 1/s-j ACCEPT

Mitigating CC attacks
When the Apache site is hit by a serious cc attack, we can use Iptables to prevent the Web server from being cc-attacked and automatically masking attack IPs.

1. System Requirements
(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, more cumbersome, but also achievable).
(2) iptables version: 1.3.7

2. Installation
Install the kernel modules corresponding to the iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit

3. Configure the corresponding iptables rules

Examples are as follows:

(1) Control the maximum number of concurrent connections for a single IP
Iptables-i input-p TCP--dport 80-m connlimit--connlimit-above 25-j REJECT #允许单个IP的最大连接数为25个

#早期iptables模块不包含connlimit, need to compile their own loading, can Baidu search does not compile kernel load connlimit module

(2) control the number of new connections allowed for a single IP at a certain time (such as 60 seconds)
Iptables-a input-p TCP--dport 80-m recent--name bad_http_access--update--seconds--hitcount 30-j
Iptables-a input-p TCP--dport 80-m recent--name bad_http_access--set-j ACCEPT

#单个IP在60秒内只允许最多新建30个连接

Real-time view of the number of connections established by the simulated attack client
Watch ' Netstat-an | grep:21 | grep < attack ip>| Wc-l

To view the number of packets that simulate an attack client being DROP
Watch ' Iptables-l-n-v | grep < attack ip>