IPTables DDOS Protection

Д

ДмитрийNZ

Green Team
22.01.2018
46
4
BIT
0
Написал правила для защиты от DoS-DDoS пользуйтесь.
  1. iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
  2. iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  3. iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
  4. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
  5. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
  6. iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  7. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
  8. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
  9. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
  10. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
  11. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
  12. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
  13. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
  14. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  15. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
  16. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  17. iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
  18. iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
  19. iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
  20. iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
  21. iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
  22. iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
  23. iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
  24. iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
  25. iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
  26. iptables -t mangle -A PREROUTING -p icmp -j DROP
  27. iptables -A INPUT -p tcp -m connlimit --connlimit-above 80 -j REJECT --reject-with tcp-reset
  28. iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
  29. iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
  30. iptables -t mangle -A PREROUTING -f -j DROP
  31. iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
  32. iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
  33. iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack
  34. iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
  35. iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
  36. /sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
  37. /sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
  38. /sbin/iptables -N port-scanning
  39. /sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
  40. /sbin/iptables -A port-scanning -j DROP
 
ДмитрийNZ сказал(а):
Написал правила для защиты от DoS-DDoS пользуйтесь.
  1. iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
  2. iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
  3. iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
  4. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
  5. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
  6. iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
  7. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
  8. iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
  9. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
  10. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
  11. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
  12. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
  13. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
  14. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
  15. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
  16. iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
  17. iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
  18. iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
  19. iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
  20. iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
  21. iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
  22. iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
  23. iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
  24. iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
  25. iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
  26. iptables -t mangle -A PREROUTING -p icmp -j DROP
  27. iptables -A INPUT -p tcp -m connlimit --connlimit-above 80 -j REJECT --reject-with tcp-reset
  28. iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
  29. iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
  30. iptables -t mangle -A PREROUTING -f -j DROP
  31. iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
  32. iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
  33. iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack
  34. iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
  35. iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
  36. /sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
  37. /sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
  38. /sbin/iptables -N port-scanning
  39. /sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
  40. /sbin/iptables -A port-scanning -j DROP
Нажмите, чтобы раскрыть...
Добрый день!
Спасибо!
А есть возможность прокоментировать каждую строку, что в ней выполняется и зачем?
 
Для ответа нужно войти/зарегистрироваться
Мы в соцсетях:

Обучение наступательной кибербезопасности в игровой форме. Начать игру!

Верх Низ