Reject DDOS attacks

Author: no double bad
On the evening of New Year's Eve, some well-known technical sites in China were unable to enter, and some people were rumored to have been suffering DDOS attacks. I am not very clear about the specifics. Now this article serves as a New Year's greeting and hopes to be useful to everyone:

1. Output filtering means limiting the source IP address of the IP packet sent from the current network to an IP address quickly. Assume 192.168.1.8

1. Create an ACL

Router1 (config) # access-list 100 permit ip 192.168.1.8.0 0.0.225 any

Ii. Implement ACL [0/0 cases of ethernet]

Router1 (config) # int eth0/0
Router1 (config-if) # ip access-group 100 in

2. input filtering

1. Enable cef on the vro

Router1 (config) # ip cef

Ii. Enable CEF for each interface

Router1 (config) # int ethernet 0/0
Router1 (config-if) # ip verify unicast reverse-path

3. Data Packets

1. Disable IP Source Routing

Router1 (config) # nop ip source-route

Ii. Disable the targeted Broadcast Application

Router1 (config) # int ethernet 0/0
Router1 (config-if) # no ip directed-broadcast

3. Disable proxy-arp

Router1 (config) # int ethernet 0/0
Router1 (config-if) # no ip proxy-arp

4. Disable ICMP redirection

Router1 (config) # int ethernet 0/0
Router1 (config-if) # no ip redirects