Optimize Linux kernel to block SYN flood attacks

Source: Internet
Author: User
SYN flood attacks (SYNFloodingAttack) are attacks that use the imperfect TCP/IP three-way handshake protocol to maliciously send a large number of packets containing only the SYN handshake sequence. This attack method may cause the attacked computer to refuse or even crash in order to keep the potential connection for a certain period of time and occupy a large amount of system resources and cannot be released. If a Linux server suffers SYN flood attacks, you can perform the following settings: # shorten the SYN-Timeout Time: I

SYN flood attacks (SYN Flooding Attack) are attacks that use the imperfect TCP/IP three-way handshake protocol to maliciously send a large number of packets containing only the SYN handshake sequence. This attack method may cause the attacked computer to refuse or even crash in order to keep the potential connection for a certain period of time and occupy a large amount of system resources and cannot be released. If a Linux server suffers SYN flood attacks, perform the following settings:

# Shorten the SYN-Timeout Time:
Iptables-a forward-p tcp -- syn-m limit -- limit 1/s-j ACCEPT
Iptables-a input-I eth0-m limit -- limit 1/sec -- limit-burst 5-j ACCEPT

# The maximum number of syn packets per second is expressed:
Iptables-N syn-flood
Iptables-a input-p tcp -- syn-j syn-flood
Iptables-A syn-flood-p tcp -- syn-m limit -- limit 1/s -- limit-burst 3-j RETURN
Iptables-A syn-flood-j REJECT

# Set syncookies:
Sysctl-w net. ipv4.tcp _ syncookies = 1
Sysctl-w net. ipv4.tcp _ max_syn_backlog = 3072
Sysctl-w net. ipv4.tcp _ synack_retries = 0
Sysctl-w net. ipv4.tcp _ syn_retries = 0
Sysctl-w net. ipv4.conf. all. send_redirects = 0
Sysctl-w net. ipv4.conf. all. accept_redirects = 0
Sysctl-w net. ipv4.conf. all. forwarding = 0
Sysctl-w net. ipv4.icmp _ echo_ignore_broadcasts = 1

# PING prevention:
Sysctl-w net. ipv4.icmp _ echo_ignore_all = 1

# Blocked specific IP address range:
Iptables-a input-s 10.0.0.0/8-I eth0-j Drop

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.