IPTABLE 减轻 DDOS 的设定

 # Make sure NEW tcp connections are SYN packets

iptables -N syn-flood iptables -A INPUT -p tcp --syn -j syn-flood iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j DROP iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

#SYN_RECV echo "1" > /proc/sys/net/ipv4/tcp_syncookies 0 echo "10" > /proc/sys/net/ipv4/tcp_fin_timeout 60 echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all 0 echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 0 echo "5000" > /proc/sys/net/ipv4/tcp_max_syn_backlog 1024
#TIME_WAIT echo "180000" > /proc/sys/net/ipv4/tcp_max_tw_buckets  180000 echo "1" > /proc/sys/net/ipv4/tcp_rfc1337 0 echo "1" > /proc/sys/net/ipv4/tcp_tw_recycle 0 echo "1" > /proc/sys/net/ipv4/tcp_tw_reuse 0 echo "5" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_time_wait 120 echo "10" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_recv 60 echo "10" > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_syn_sent 120


防止同步包洪水（Sync Flood）  # iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT  也有人写作  #iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT  --limit 1/s 限制syn并发数每秒1次，可以根据自己的需要修改 防止各种端口扫描  # iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT  Ping洪水攻击（Ping of Death）  # iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT