iptables 限速配置

1、connlimit: 连接数限制,对每IP所能够发起并发连接数做限制;
# iptables -A INPUT -p tcp -m tcp –dport 22 -m connlimit –connlimit-above 3 –connlimit-mask 32 –connlimit-saddr -j DROP
# iptables -A INPUT -p tcp -m tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -p tcp -m state –state ESTABLISHED -j ACCEPT

2、对ssh进行管控,1小时内最多发起5个连接,防止黑客暴力破解ssh

# iptabels -A INPUT -d 192.168.1.0/24 -p tcp –syn –dport 22 -m state –state NEW -m recent –update –seconds 3600 –hitcount 3 –name ssh_limits -j DROP
# iptables -A INPUT -p tcp –syn -m state –state NEW -m recent –name ssh_limits -j ACCEPT
# iptables -A OUTPUT -p tcp -m state –state ESTABLISHED -j ACCEPT

3、对ping包数量管控
iptables -A INPUT -p icmp -m icmp –icmp-type 8 -m limit –limit 10/min –limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp
4、附带samba防火墙配置
# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Tue Nov 14 11:51:37 2017
*filter
:INPUT DROP [1:328]
:FORWARD DROP [0:0]
:OUTPUT DROP [1:328]
-A INPUT -p tcp -m tcp –dport 22 –tcp-flags FIN,SYN,RST,ACK SYN -m connlimit –connlimit-above 3 –connlimit-mask 32 –connlimit-saddr -j DROP
-A INPUT -d 192.168.1.0/24 -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -m multiport –dports 22,445 -m state –state NEW -m recent –update –seconds 3600 –hitcount 5 –name tcp_limits –mask 255.255.255.255 –rsource -j DROP
-A INPUT -d 192.168.1.0/24 -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -m state –state NEW -m multiport –dports 22,445 -m recent –set –name tcp_limits –mask 255.255.255.255 –rsource -j ACCEPT
-A INPUT -p icmp -m icmp –icmp-type 8 -m limit –limit 10/min –limit-burst 10 -j ACCEPT
-A INPUT -p icmp -m state –state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -m connlimit –connlimit-above 3 –connlimit-mask 32 –connlimit-saddr -j DROP
-A INPUT -m state –state ESTABLISHED -j ACCEPT
-A OUTPUT -m state –state ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -m state –state NEW -m icmp –icmp-type 8 -j ACCEPT
COMMIT
# Completed on Tue Nov 14 11:51:37 2017

  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值