IPTABLE减轻DDOS的设定
1517 点击·0 回帖
灯火互联
楼主
 |  | |
 | # Make sure NEW tcp connections are SYN packets iptables -N syn-flood iptables -A INPUT -p tcp --syn -j syn-flood iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j DROP iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP #SYN_RECV echo "1" > /proc/sys/net/ipv4/tcp_syncookies 0 echo "10" > /proc/sys/net/ipv4/tcp_fin_timeout 60 echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all 0 echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 0 echo "5000" > /proc/sys/net/ipv4/tcp_max_syn_backlog 1024 #TIME_WAIT echo "180000" > /proc/sys/net/ipv4/tcp_max_tw_buckets 180000 echo "1" > /proc/sys/net/ipv4/tcp_rfc1337 0 echo "1" > /proc/sys/net/ipv4/tcp_tw_recycle 0 echo "1" > /proc/sys/net/ipv4/tcp_tw_reuse 0 echo "5" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_time_wait 120 echo "10" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv 60 echo "10" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_sent 120 防止同步包洪水（Sync Flood） # iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT 也有人写作 #iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT --limit 1/s 限制syn并发数每秒1次，可以根据自己的需要修改 防止各种端口扫描 # iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT Ping洪水攻击（Ping of Death） # iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT | |
 |  |