本软件能实现在受到DDOS的cc、syn半连接等功击时，进行比较有效的防御。实际上，它并不具备阻截能力，它是基于IPtables防火墙，利用netstat+过滤规则，与IPtables防火墙实现联动。在有恶意连接（例如syn flood）***服务器指定端口时，本软件会实时分析连接来源的企图。当连接IP有多并发恶意连接时，软件自动将其加入iptables防火墙条目进行阻截。同时将***IP记录到计划解封文件里，当达到预定时间后，软件自动从IPtables防火墙中解封对应IP。

本软件利用了一周时间写完，在基本测试过程中，表现还可以。但不排除有BUG的可能。应付单IP并发连接***、单IP的syn flood等效果明显。由此可见，它也不适合于随机IP的恶意***。

系统结构图

安装使用：

本软件安装方式十分简单，下载软件后解压（tar zxvf DDos_firewall-v1.0.0.tar.gz），进入主目录，找到autosetup.sh，运行自动安装即可！

运行环境：

centos 32bit or 64bit 、redhat 32bit or 64bit、fedora 32bit or 64bit，其他linux未测试。

启动方式：

dd_start {start|stop|restart|status}

运行状态/IP封锁图

配置实例：

 

 
  1. #############################################
  2. ### FileName:ddos_drop.conf
  3. ### Auth:Sunshine Gu
  4. ### http://blog.hit008.com
  5. ### ddos_acl and flush_drop config file.
  6. #############################################
  7.  
  8. [main setting]
  9. ### Main directory
  10. filepath=/usr/local/ddos_drop
  11.  
  12. ### Pid file
  13. ddos_acl_pidfile=/usr/local/ddos_drop/logs/ddos_acl.pid
  14. flush_drop_pidfile=/usr/local/ddos_drop/logs/flush_drop.pid
  15.  
  16. ### Temporary blacklist
  17. grep_list=/usr/local/ddos_drop/logs/drop_ip.dat
  18.  
  19. ### Plans to remove(blacklist)
  20. crond_list=/usr/local/ddos_drop/logs/crond_list.dat
  21.  
  22. ### Temporary file,used to clean blacklist queue in crond_list.
  23. temp_list=/usr/local/ddos_drop/logs/temp_list~
  24.  
  25.  
  26. ### White list
  27. else_list=192.168.14.15|127.0.0.1|0.0.0.0
  28.  
  29. ### Monitor port
  30. grep_port=80|8080|443
  31.  
  32. ### Executive frequency(s)
  33. exec_time=10
  34.  
  35. ### Lock time,used to lock blacklist in grep_list,
  36. ### Over this time, iptables will automatically delete.(s)
  37. acl_cls=3600
################################################ FileName:ddos_drop.conf### Auth:Sunshine Gu### http://blog.hit008.com### ddos_acl and flush_drop config file.#############################################[main setting]### Main directoryfilepath=/usr/local/ddos_drop### Pid fileddos_acl_pidfile=/usr/local/ddos_drop/logs/ddos_acl.pidflush_drop_pidfile=/usr/local/ddos_drop/logs/flush_drop.pid### Temporary blacklistgrep_list=/usr/local/ddos_drop/logs/drop_ip.dat### Plans to remove(blacklist)crond_list=/usr/local/ddos_drop/logs/crond_list.dat### Temporary file,used to clean blacklist queue in crond_list.temp_list=/usr/local/ddos_drop/logs/temp_list~### White listelse_list=192.168.14.15|127.0.0.1|0.0.0.0### Monitor portgrep_port=80|8080|443### Executive frequency(s)exec_time=10### Lock time,used to lock blacklist in grep_list,### Over this time, iptables will automatically delete.(s)acl_cls=3600

《Shell源码开源》

1. 主守护程序，ddos_acl.sh

 
  1. #!/bin/sh
  2.  
  3. ########################################
  4. ### FileName: ddos_acl.sh
  5. ### Auth: Sunshine GU
  6. ### Version: v1.0.0
  7. ### http://blog.hit008.com
  8. ########################################
  9.  
  10. ############################################载入配置文件########################################
  11. ###文件主目录 [filepath]
  12. ###PID文件 [pidfile]
  13. ###临时黑名单 [grep_list]
  14. ###计划清除队列 [crond_list]
  15. ###白名单 [else_list]
  16. ###监控端口 [grep_port]
  17. ###执行频率(s) [exec_time]
  18. conffile=../conf/ddos_drop.conf
  19. if [ -e $conffile ];then
  20. #cat $conffile|awk -v key="main" -v RS='\\[[^\n]*]' 'v=="["key"]";{v=RT}'|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'
  21. filepath=`grep 'filepath=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  22. ddos_acl_pidfile=`grep 'ddos_acl_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  23. flush_drop_pidfile=`grep 'flush_drop_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  24. grep_list=`grep 'grep_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  25. crond_list=`grep 'crond_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  26. temp_list=`grep 'temp_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  27. else_list=`grep 'else_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  28. grep_port=`grep 'grep_port=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  29. exec_time=`grep 'exec_time=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  30. acl_cls=`grep 'acl_cls=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  31. else
  32. echo "Can't find the configuration file!"
  33. exit 1
  34. fi
  35. ################################################################################################
  36.  
  37. ###清空旧的非法IP
  38. if [ -d $filepath/logs ];then
  39. if [ -f $grep_list ];then
  40. rm -f $grep_list
  41. fi
  42. else
  43. mkdir $filepath/logs
  44. fi
  45.  
  46.  
  47. ###根据连接状态进行IP屏蔽
  48. echo "$$" > $ddos_acl_pidfile
  49. while true
  50. do
  51. #根据连接数反应恶意连接,并记录连接ip
  52. /bin/netstat -ant |grep -E $grep_port|awk '{print $5}'|awk -F : '{print $1}'|sort|uniq -c|sort -rn|grep -v -E $else_list|awk '{if ($2!=null && $1>100) {print $2}}' > $grep_list
  53. if [ -f $grep_list ];then
  54. #遍历不重复的条目
  55. for i in `cat $grep_list|uniq -c|awk '{print $2}'`
  56. do
  57. #要求iptables没有重复条目
  58. if [ `iptables --list|grep $i|wc -l` -eq 0 ];then
  59. #记录非法IP信息,并进行封闭
  60. echo "$i `date +%Y/%m/%d` `date +%H:%M:%S` `date +%s` LOCK" >> $crond_list
  61. /sbin/iptables -I INPUT -s $i -j DROP;
  62. else
  63. continue
  64. fi
  65. done
  66. fi
  67. sleep $exec_time
  68. done
#!/bin/sh########################################### FileName: ddos_acl.sh### Auth: Sunshine GU### Version: v1.0.0### http://blog.hit008.com####################################################################################载入配置文件###########################################文件主目录 [filepath]###PID文件 [pidfile]###临时黑名单 [grep_list]###计划清除队列 [crond_list]###白名单 [else_list]###监控端口 [grep_port]###执行频率(s) [exec_time]conffile=../conf/ddos_drop.confif [ -e $conffile ];then#cat $conffile|awk -v key="main" -v RS='\\[[^\n]*]' 'v=="["key"]";{v=RT}'|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'filepath=`grep 'filepath=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`ddos_acl_pidfile=`grep 'ddos_acl_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`flush_drop_pidfile=`grep 'flush_drop_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`grep_list=`grep 'grep_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`crond_list=`grep 'crond_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`temp_list=`grep 'temp_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`else_list=`grep 'else_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`grep_port=`grep 'grep_port=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`exec_time=`grep 'exec_time=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`acl_cls=`grep 'acl_cls=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`elseecho "Can't find the configuration file!"exit 1fi###################################################################################################清空旧的非法IPif [ -d $filepath/logs ];then  if [ -f $grep_list ];then    rm -f $grep_list  fielsemkdir $filepath/logsfi###根据连接状态进行IP屏蔽echo "$$" > $ddos_acl_pidfilewhile truedo   #根据连接数反应恶意连接,并记录连接ip   /bin/netstat -ant |grep -E $grep_port|awk '{print $5}'|awk -F : '{print $1}'|sort|uniq -c|sort -rn|grep -v -E $else_list|awk '{if ($2!=null && $1>100) {print $2}}' > $grep_list   if [ -f $grep_list ];then     #遍历不重复的条目     for i in `cat $grep_list|uniq -c|awk '{print $2}'`       do         #要求iptables没有重复条目         if [ `iptables --list|grep $i|wc -l` -eq 0 ];then            #记录非法IP信息,并进行封闭            echo "$i `date +%Y/%m/%d` `date +%H:%M:%S` `date +%s` LOCK" >> $crond_list            /sbin/iptables -I INPUT -s $i -j DROP;         else            continue         fi     done   fisleep $exec_timedone

2. 计划解封程序，flush_drop.sh

 
  1. #!/bin/sh
  2.  
  3. ########################################
  4. ### FileName: flush_drop.sh
  5. ### Auth: Sunshine GU
  6. ### Version: v1.0.0
  7. ### http://blog.hit008.com
  8. ########################################
  9.  
  10. ############################################载入配置文件########################################
  11. ###文件主目录 [filepath]
  12. ###PID文件 [pidfile]
  13. ###临时黑名单 [grep_list]
  14. ###计划清除队列 [crond_list]
  15. ###白名单 [else_list]
  16. ###监控端口 [grep_port]
  17. ###执行频率(s) [exec_time]
  18. conffile=../conf/ddos_drop.conf
  19. if [ -e $conffile ];then
  20. #cat $conffile|awk -v key="main" -v RS='\\[[^\n]*]' 'v=="["key"]";{v=RT}'|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'
  21. filepath=`grep 'filepath=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  22. ddos_acl_pidfile=`grep 'ddos_acl_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  23. flush_drop_pidfile=`grep 'flush_drop_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  24. grep_list=`grep 'grep_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  25. crond_list=`grep 'crond_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  26. temp_list=`grep 'temp_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  27. else_list=`grep 'else_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  28. grep_port=`grep 'grep_port=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  29. exec_time=`grep 'exec_time=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  30. acl_cls=`grep 'acl_cls=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`
  31. else
  32. echo "Can't find the configuration file!"
  33. exit 1
  34. fi
  35. ################################################################################################
  36.  
  37. echo "$$" > $flush_drop_pidfile
  38.  
  39. while true
  40. do
  41. sleep $exec_time
  42. #取得当前时间
  43. nowtime=`date +%s`
  44. #文件是否存在
  45. if [ -e $crond_list ];then
  46. #遍历所有条目
  47. for i in `awk '{print $1}' $crond_list`
  48. do
  49. #内容不为空
  50. if [ `cat $crond_list|wc -l` -ne 0 ];then
  51. #单次最多取出一条,排除重复条目
  52. ti=`grep $i $crond_list|awk '{print $4}'|head -1`
  53. b=`expr $nowtime - $ti`
  54. #判断是否超规定时间
  55. if [ $b -gt $acl_cls ];then
  56. #iptables里存在条目
  57. if [ `iptables --list|grep $i|wc -l` -ne 0 ];then
  58. /sbin/iptables -D INPUT -s $i -j DROP
  59. fi
  60. #清除crond_list的当前条目
  61. cp $crond_list $temp_list
  62. sed -e "/$i/d" $temp_list > $crond_list
  63. rm -f $temp_list
  64. fi
  65. fi
  66. done
  67. fi
  68. done
#!/bin/sh########################################### FileName: flush_drop.sh### Auth: Sunshine GU### Version: v1.0.0### http://blog.hit008.com####################################################################################载入配置文件###########################################文件主目录 [filepath]###PID文件 [pidfile]###临时黑名单 [grep_list]###计划清除队列 [crond_list]###白名单 [else_list]###监控端口 [grep_port]###执行频率(s) [exec_time]conffile=../conf/ddos_drop.confif [ -e $conffile ];then#cat $conffile|awk -v key="main" -v RS='\\[[^\n]*]' 'v=="["key"]";{v=RT}'|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'filepath=`grep 'filepath=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`ddos_acl_pidfile=`grep 'ddos_acl_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`flush_drop_pidfile=`grep 'flush_drop_pidfile=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`grep_list=`grep 'grep_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`crond_list=`grep 'crond_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`temp_list=`grep 'temp_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`else_list=`grep 'else_list=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`grep_port=`grep 'grep_port=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`exec_time=`grep 'exec_time=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`acl_cls=`grep 'acl_cls=' $conffile|sed 's/ //g'|sed -r '/^ *#.*/d;s/ *#.*//'|awk -F = '{print $2}'`elseecho "Can't find the configuration file!"exit 1fi################################################################################################echo "$$" > $flush_drop_pidfilewhile truedosleep $exec_time#取得当前时间nowtime=`date +%s`#文件是否存在  if [ -e $crond_list ];then    #遍历所有条目    for i in `awk '{print $1}' $crond_list`    do      #内容不为空      if [ `cat $crond_list|wc -l` -ne 0 ];then      #单次最多取出一条,排除重复条目      ti=`grep $i $crond_list|awk '{print $4}'|head -1`      b=`expr $nowtime - $ti`        #判断是否超规定时间        if [ $b -gt $acl_cls ];then         #iptables里存在条目         if [ `iptables --list|grep $i|wc -l` -ne 0 ];then         /sbin/iptables -D INPUT -s $i -j DROP         fi          #清除crond_list的当前条目          cp $crond_list $temp_list          sed -e "/$i/d" $temp_list > $crond_list          rm -f $temp_list        fi      fi    done  fidone

3. 主启动程序，dd_start.sh

 
  1. #!/bin/sh
  2.  
  3. #############################################
  4. ### FileName:autosetup.sh
  5. ### Auth:Sunshine Gu
  6. ### Version: v1.0.0
  7. ### http://blog.hit008.com
  8. ### Bash shell for start DDos_Drop.
  9. #############################################
  10.  
  11. ### Main directory
  12. filepath=/usr/local/ddos_drop
  13. ### Program name
  14. DAEMON=$filepath/bin/ddos_acl
  15. FLUSHIP=$filepath/bin/flush_drop
  16.  
  17. ### Plans to remove(blacklist)
  18. crond_list=$filepath/logs/crond_list.dat
  19.  
  20. ### White list
  21. else_list='127.0.0.1|0.0.0.0'
  22.  
  23. ### Monitor port
  24. grep_port='80|8080|443'
  25.  
  26. ### Pid file
  27. pidfile1=$filepath/logs/ddos_acl.pid
  28. pidfile2=$filepath/logs/flush_drop.pid
  29.  
  30. set -e
  31. [ -x "$DAEMON" ] || exit 0
  32.  
  33.  
  34. do_start() {
  35. if [ `pgrep -f 'ddos_acl'|wc -l` -eq 0 ];then
  36. $DAEMON &
  37. $FLUSHIP &
  38. else
  39. echo -e "ddos_acl already running!"
  40. exit 1
  41. fi
  42. }
  43.  
  44. do_stop() {
  45. if [ `pgrep -f 'ddos_acl'|wc -l` -eq 0 ];then
  46. echo -e "ddos_acl not running!"
  47. else
  48. kill -9 `cat $pidfile1`
  49. fi
  50.  
  51. if [ `pgrep -f 'flush_drop'|wc -l` -eq 0 ];then
  52. echo -e "flush_drop not running!"
  53. else
  54. kill -9 `cat $pidfile2`
  55. fi
  56.  
  57. if [ `pgrep -f 'flush_drop'|wc -l` -ne 0 ]&&[ `pgrep -f 'flush_acl'|wc -l` -ne 0 ];then
  58. kill -9 `cat $pidfile1`
  59. kill -9 `cat $pidfile2`
  60. rm -rf $pidfile1 $pidfile2
  61. fi
  62. }
  63.  
  64. do_restart() {
  65. do_stop
  66. do_start
  67. }
  68.  
  69. do_status() {
  70. echo "###---------------------------DROP LIST----------------------------- ###"
  71. echo "IP Y/m/d H:M:S Unix/time Active"
  72. if [ -e $crond_list ];then
  73. cat $crond_list
  74. else
  75. echo "no information..."
  76. fi
  77. echo "###---------------------------IPTABLES LIST--------------------------###"
  78. echo "target prot opt source destination"
  79. iptables --list|grep 'DROP'|awk {'printf "%-10s%-5s%-4s%-20s%-11s\n",$1,$2,$3,$4,$5'}
  80. echo "###---------------------------NETSTAT STATUS-------------------------###"
  81. echo "Num Proto Recv-Q Send-Q Local Address Foreign Address State"
  82. netstat -ant |grep -E $grep_port|grep -v -E $else_list|sed 's/:/ /g'|awk '{print $1,$2,$3,$4,$6,$8}'|sort|uniq -c|awk '{printf "%-6s%-06s%-07s%-07s%-20s%-20s%-10s\n",$1,$2,$3,$4,$5,$6,$7}'
  83. echo "###------------------------------------------------------------------###"
  84. if [ `pgrep -f 'ddos_acl'|wc -l` -ne 0 ];then
  85. echo -n ">>> ddos_acl already running! "
  86. else
  87. echo -n ">>> ddos_acl not running! "
  88. fi
  89. if [ `pgrep -f 'flush_drop'|wc -l` -ne 0 ];then
  90. echo " flush_drop already running! <<<"
  91. else
  92. echo " flush_drop not running! <<<"
  93. fi
  94.  
  95. }
  96.  
  97. case "$1" in
  98. start)
  99. echo -e "Starting ddos_acl ..."
  100. do_start
  101. echo "Done."
  102. ;;
  103. stop)
  104. echo -e "Stopping ddos_acl ..."
  105. do_stop
  106. echo "Done."
  107. ;;
  108. restart)
  109. echo -e "Restarting ddos_acl ..."
  110. do_restart
  111. echo "Done."
  112. ;;
  113. status)
  114. while true
  115. do
  116. clear
  117. do_status
  118. sleep 3
  119. done
  120. ;;
  121. *)
  122. echo $"Usage: $prog {start|stop|restart|status}"
  123. exit 1
  124. esac
#!/bin/sh################################################ FileName:autosetup.sh### Auth:Sunshine Gu### Version: v1.0.0### http://blog.hit008.com### Bash shell for start DDos_Drop.################################################ Main directoryfilepath=/usr/local/ddos_drop### Program nameDAEMON=$filepath/bin/ddos_aclFLUSHIP=$filepath/bin/flush_drop### Plans to remove(blacklist)crond_list=$filepath/logs/crond_list.dat### White listelse_list='127.0.0.1|0.0.0.0'### Monitor portgrep_port='80|8080|443'### Pid filepidfile1=$filepath/logs/ddos_acl.pidpidfile2=$filepath/logs/flush_drop.pidset -e[ -x "$DAEMON" ] || exit 0do_start() {        if [ `pgrep -f 'ddos_acl'|wc -l` -eq 0 ];then       $DAEMON &                   $FLUSHIP &        else       echo -e "ddos_acl already running!"       exit 1    fi}do_stop() {        if [ `pgrep -f 'ddos_acl'|wc -l` -eq 0 ];then        echo -e "ddos_acl not running!"  else                    kill -9 `cat $pidfile1`        fi                  if [ `pgrep -f 'flush_drop'|wc -l` -eq 0 ];then                    echo -e "flush_drop not running!"        else                          kill -9 `cat $pidfile2`        fi              if [ `pgrep -f 'flush_drop'|wc -l` -ne 0 ]&&[ `pgrep -f 'flush_acl'|wc -l` -ne 0 ];then        kill -9 `cat $pidfile1`                    kill -9 `cat $pidfile2`             rm -rf $pidfile1 $pidfile2  fi}do_restart() {        do_stop        do_start}do_status() {                echo "###---------------------------DROP LIST----------------------------- ###"    echo "IP           Y/m/d      H:M:S   Unix/time   Active"    if [ -e $crond_list ];then       cat $crond_list    else       echo "no information..."    fi    echo "###---------------------------IPTABLES LIST--------------------------###"    echo "target    prot opt source              destination"    iptables --list|grep 'DROP'|awk {'printf "%-10s%-5s%-4s%-20s%-11s\n",$1,$2,$3,$4,$5'}    echo "###---------------------------NETSTAT STATUS-------------------------###"                echo "Num   Proto Recv-Q Send-Q Local Address       Foreign Address     State"                 netstat -ant |grep -E $grep_port|grep -v -E $else_list|sed 's/:/ /g'|awk '{print $1,$2,$3,$4,$6,$8}'|sort|uniq -c|awk '{printf "%-6s%-06s%-07s%-07s%-20s%-20s%-10s\n",$1,$2,$3,$4,$5,$6,$7}'                echo "###------------------------------------------------------------------###"                if [ `pgrep -f 'ddos_acl'|wc -l` -ne 0 ];then                   echo -n ">>> ddos_acl already running! "                else                   echo -n ">>> ddos_acl not running! "                fi                if [ `pgrep -f 'flush_drop'|wc -l` -ne 0 ];then                   echo  " flush_drop already running! <<<"                else                   echo " flush_drop not running! <<<"                fi}case "$1" in  start)        echo -e "Starting ddos_acl ..."        do_start    echo "Done."        ;;  stop)        echo -e "Stopping ddos_acl ..."        do_stop    echo "Done."        ;;  restart)        echo -e "Restarting ddos_acl ..."        do_restart    echo "Done."        ;;  status)        while true        do        clear        do_status        sleep 3        done        ;;      *)        echo $"Usage: $prog {start|stop|restart|status}"        exit 1esac

软件需安装到指定路径下（/usr/local/），安装好的目录有：

/usr/local/ddos_drop/bin，为执行文件目录

/usr/local/ddos_drop/conf，配置文件目录

/usr/local/ddos_drop/logs，记录文件目录

提供下载的为打包C文件，需要经过gcc编译。启动autosetup.sh 即可完成gcc编译和安装！

软件：DDos Firewall-v1.0.0

点击这里下载文件