Iptables Anti-DDoS Rules

You can use the below iptables ruleset for additional DDoS protection of your Linux server.

#Drop invalid packets
/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP  

#Drop TCP packets that are new and are not SYN
/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
 
#Drop SYN packets with suspicious MSS value
/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP  

#Block packets with bogus TCP flag
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP  

#Block spoofed packets
/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
/sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP  

#Drop ICMP (you usually don't need this protocol)
/sbin/iptables -t mangle -A PREROUTING -p icmp -j DROP  

#Drop fragments in all chains
/sbin/iptables -t mangle -A PREROUTING -f -j DROP  

#Limit connections per source IP
/sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset  

#Limit RST packets
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP  

#Limit new TCP connections per second per source IP
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP 

  • 0 utilizatori au considerat informaţia utilă
Răspunsul a fost util?

Articole similare

How to Install CS:GO server on CentOS 7

In this tutorial I'll explain how to setup a Counter-Strike: Global Offensive server. The steps...

How to Install CS:GO server on Ubuntu

This tutorial will show you on how to install a Counter-Strike: Global Offensive Server on your...

How to Secure and Harden a VPS (CentOS/Ubuntu)

This tutorial will show you on how to secure and harden your Ubuntu or CentOS VPS. RequirementsA...

How to Install Fail2Ban (Ubuntu/CentOS)

This tutorial will show you on how to install Fail2Ban on your Ubuntu or CentOS VPS....

How to Install Let's Encrypt (CentOS/Debian/Ubuntu)

This tutorial will show you on how to install a Let's Encrypt on your Ubuntu, Debian or CentOS...