Optimize LINUX kernel block SYN flood attack __linux

SYN flood attack (SYN flooding Attack) refers to the use of TCP/IP three-time handshake protocol is imperfect and malicious send a large number of only SYN handshake sequence packets of attack mode. This type of attack could lead to a denial of service and even crashes in the case of an attacking computer that is unable to be freed by a large amount of system resources during a certain period of time to maintain a potential connection. If you suffer from a SYN flood attack under a Linux server, you can do the following:

#缩短SYN-timeout Time:
Iptables-a forward-p tcp–syn-m limit–limit 1/s-j
Iptables-a input-i eth0-m limit–limit 1/sec–limit-burst 5-j

#每秒 up to 3 SYN packets entered are expressed as:
Iptables-n Syn-flood
Iptables-a input-p tcp–syn-j Syn-flood
Iptables-a syn-flood-p tcp–syn-m limit–limit 1/s–limit-burst 3-j return
Iptables-a syn-flood-j REJECT

#设置syncookies:
Sysctl-w Net.ipv4.tcp_syncookies=1
Sysctl-w net.ipv4.tcp_max_syn_backlog=3072
Sysctl-w net.ipv4.tcp_synack_retries=0
Sysctl-w net.ipv4.tcp_syn_retries=0
Sysctl-w net.ipv4.conf.all.send_redirects=0
Sysctl-w net.ipv4.conf.all.accept_redirects=0
Sysctl-w net.ipv4.conf.all.forwarding=0
Sysctl-w Net.ipv4.icmp_echo_ignore_broadcasts=1

#防止PING:
Sysctl-w net.ipv4.icmp_echo_ignore_all=1

#拦截具体IP范围:
Iptables-a input-s 10.0.0.0/8-I. eth0-j Drop
Turn from: http://www.hit008.com/read.php?30