iptables 限速配置

1、connlimit: 连接数限制，对每IP所能够发起并发连接数做限制；
# iptables -A INPUT -p tcp -m tcp –dport 22 -m connlimit –connlimit-above 3 –connlimit-mask 32 –connlimit-saddr -j DROP
# iptables -A INPUT -p tcp -m tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -p tcp -m state –state ESTABLISHED -j ACCEPT

2、对ssh进行管控，1小时内最多发起5个连接，防止黑客暴力破解ssh

# iptabels -A INPUT -d 192.168.1.0/24 -p tcp –syn –dport 22 -m state –state NEW -m recent –update –seconds 3600 –hitcount 3 –name ssh_limits -j DROP
# iptables -A INPUT -p tcp –syn -m state –state NEW -m recent –name ssh_limits -j ACCEPT
# iptables -A OUTPUT -p tcp -m state –state ESTABLISHED -j ACCEPT

3、对ping包数量管控
iptables -A INPUT -p icmp -m icmp –icmp-type 8 -m limit –limit 10/min –limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp
4、附带samba防火墙配置
# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Tue Nov 14 11:51:37 2017
*filter
:INPUT DROP [1:328]
:FORWARD DROP [0:0]
:OUTPUT DROP [1:328]
-A INPUT -p tcp -m tcp –dport 22 –tcp-flags FIN,SYN,RST,ACK SYN -m connlimit –connlimit-above 3 –connlimit-mask 32 –connlimit-saddr -j DROP
-A INPUT -d 192.168.1.0/24 -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -m multiport –dports 22,445 -m state –state NEW -m recent –update –seconds 3600 –hitcount 5 –name tcp_limits –mask 255.255.255.255 –rsource -j DROP
-A INPUT -d 192.168.1.0/24 -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -m state –state NEW -m multiport –dports 22,445 -m recent –set –name tcp_limits –mask 255.255.255.255 –rsource -j ACCEPT
-A INPUT -p icmp -m icmp –icmp-type 8 -m limit –limit 10/min –limit-burst 10 -j ACCEPT
-A INPUT -p icmp -m state –state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -m connlimit –connlimit-above 3 –connlimit-mask 32 –connlimit-saddr -j DROP
-A INPUT -m state –state ESTABLISHED -j ACCEPT
-A OUTPUT -m state –state ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m state –state NEW -m icmp –icmp-type 8 -j ACCEPT
COMMIT
# Completed on Tue Nov 14 11:51:37 2017