iptables ddos

Anti-DDoS script # Lightweight prevention against SYN AttacksIptables-N syn-floodIptables-A input-p tcp-syn-J syn-floodIptables-I syn-flood-P TCP-m limit-limit 3/s-limit-burst 6-J returnIptables-a syn-flood-J reject # Prevent too many Dos connections. You can allow up to 15 Initial connections from each IP address of the Internet Nic, exceeding the limit of discardingIptables-A input-I eth0-P TCP-syn-M connlimit-abve 15-J DropIptables-A input-p tcp-M

The main 2 basic practical applications, mainly related to the ban Ping (IPv4) and the prohibition of UDP, that is, the use of the server to prevent hackers to outsource DDoS attack content. First, if there is no iptables prohibit ping echo 1 >/proc/sys/net/ipv4/icmp_echo_igore_all #开启echo 0 >/proc/sys/net/ipv4/icmp_echo_igore_all #关闭 Second, the iptables to p

This article introduces how Iptables limits the number of connections of the same IP address in linux to prevent CC/DDOS attacks. This is only the most basic method. If the attack is real, we still need hardware compaction to prevent it. 1. Set the maximum number of connections to port 80 to 10, which can be customized. The Code is as follows: Copy code

Mitigating DDoS attacks#防止SYN攻击, lightweight preventionIptables-n Syn-floodIptables-a input-p tcp–syn-j Syn-floodIptables-i syn-flood-p tcp-m limit–limit 3/s–limit-burst 6-j returnIptables-a syn-flood-j REJECT #防止DOS太多连接进来, you can allow the external network card to each IP up to 15 initial connections, over the discardedIptables-a input-i eth0-p tcp–syn-m connlimit–connlimit-above 15-j DROPIptables-a input-p tcp-m state–state established,related-j

#!/bin/bash/bin/netstat-na |grep established |awk ' {print $} ' |awk-f: ' {print $} ' | Sed '/^$/d ' |sort|uniq-c|sort-rn|head-n 10|grep-v-e ' 192.168|127.0′|sed '/^$/d ' |awk ' {if ($2!=null $1> ; 10); {print $}} ' >/tmp/dropipFor I in $ (CAT/TMP/DROPIP)Todo/sbin/iptables-a input-s $i-j DROPecho "$i kill at ' Date '" >>/var/log/ddosDone 2. Increased executive authority The code is as follows Copy Code

1. Limit the number of IP connections to 80 ports to a maximum of 10, which can be customized. The code is as follows Copy Code Iptables-i input-p TCP--dport 80-m connlimit--connlimit-above 10-j DROP 2. Use the recent module to limit the number of new requests in the same IP time, recent more features please refer to: Iptables Module recent application.

1. Limit the maximum number of IP connections to a 80-port connection to 10, which can be customized to modify. The code is as follows Copy Code Iptables-i input-p TCP--dport 80-m connlimit--connlimit-above DROP 2. Use the recent module to limit the number of new requests connected to the same IP time, recent more features please refer to: Iptables Module recent applic

The script is as follows: Copy Code code as follows: #!/bin/sh Nginx_home =/data/app_1/nginx Log_path =/data/logs /usr/bin/tail-n50000 $log _path/access.log \ |awk ' ~/aspx/{print $2,$13} ' |grep-i-v-e "google|yahoo|baidu|msnbot| Feedsky|sogou "\ |awk ' {print $} ' |sort|uniq-c |sort-rn \ |awk ' {if ($1>150) print "Deny" $2″; "}" > $nginx _home/conf/vhosts/blockip.conf /bin/kill-hup ' Cat $nginx _home/nginx.pid ' can also be analyzed by the Nginx log filte

The script is as follows: CopyCode The Code is as follows :#! /Bin/sh Nginx_home =/data/app_1/nginx Log_path =/data/logs /Usr/bin/tail-n50000 $ log_path/access. log \ | Awk '$8 ~ /Aspx/{print $2, $13 }'\ | Grep-I-v-e "Google | Yahoo | Baidu | msnbot | feedsky | sogou "\ | Awk '{print $1}' | sort | uniq-c | sort-RN \ | Awk '{if ($1> 150) print "deny" $2 ";"}'> $ nginx_home/CONF/vhosts/blockip. conf /Bin/kill-HUP 'cat $ nginx_home/nginx. Pi' You can also filter out frequently accessed IP address

CC attack a bit siege feeling, the correct setting of protection rules can be done in a very unstable, here gives a iptables IP connection frequency and concurrency restrictions, limit the single IP connection and frequency of the set rules introduced #单个IP在60秒内只允许新建20个连接, this assumes that the Web port is 80, Copy Code code as follows: Iptables-i input-i eth1-p tcp-m tcp–dport 80-m state–st