功能强大且抗DDoS的iptables脚本

最新推荐文章于 2022-07-28 11:00:02 发布
最新推荐文章于 2022-07-28 11:00:02 发布
阅读量1.6k 收藏 2
点赞数 2
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zzjiwang/article/details/78013579
版权 
#!/bin/bash
# Description: This script applies to both RHEL and CentOS systems.This is 
# a powerful firewall, anti DDOS attacks, and not limitedto this, you can
# make your Linux server as router, http/ftp server etc. ,but also as 
# required to open SNAT, DNAT function.
# Author:JianJie
# Version:1.0
# Date:2017-09-17




# Checking if script is run as root
if [ $(id -u) -ne 0 ];then
    echo "Script is not run as root, exiting..."
    exit 1
fi
# To avoid being unable to connect to the server, the following schedule has been worked out
string=$(cat /etc/redhat-release)
vers=$(echo ${string##*release}|sed 's/^[[:space:]]*//g'|awk -F"." '{print $1}')
if [ $vers -eq 7 ];then
   if echo "*/3 * * * * /usr/bin/systemctl stop iptables.service" >> /etc/crontab ;then
      echo "Plans have been added to /etc/crontab: */3 * * * * /usr/bin/systemctl stop iptables.service"
      echo "If you are sure that iptables will work properly, you can close the schedule task"
   else
      echo "Failed to add task plan to /etc/crontab,stop running this script for security"
      exit 1
   fi
elif [ $vers -eq 6 ];then
   if echo "*/3 * * * * /sbin/service iptables stop" >> /etc/crontab ;then
      echo "Plans have been added to /etc/crontab: */3 * * * * /sbin/service iptables stop"
      echo "If you are sure that iptables will work properly, you can close the schedule task"
   else
      echo "Failed to add task plan to /etc/crontab,stop running this script for security"
      exit 1
   fi
else
   echo "Your system is not RHEL or CentOS, if you want to use this script, you can manually modify certain code,now exit"
   exit 1
fi
########################GLOBAL_PARAMETER_SETING_START#####################


export PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin"
IPTABLES="/sbin/iptables" 
MODPROBE="/sbin/modprobe"
IP6TABLES="/sbin/ip6tables"
IP="/usr/sbin/ip"
# Internal web server IP addr
HTTP_SERVER="" 
# Internal ftp server IP addr
FTP_SERVER="172.16.0.66"
# Internal dns server IP addr
DNS_SERVER=""
# The path to the script is currently running
RUN_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" 
# Enable ip froward
IP_FORWARD=1
# Enable MASQUERADE
INTERNAL_MASQUERADE_SWITCH="1"
# Enable DNAT
INTERNAL_DNAT_SWITCH="1"
# Conntrack parameter optimization
CONNTRACK_MAX=300000  #CONNTRACK_MAX=RAMSIZE(in bytes)/16384/(ARCH/32)
ESTAB_TIMEOUT=3600
TIME_WAIT=120
CLOSE_WAIT=60
FIN_WAIT=120
CONNTRACK_BUCKETS=50000  #min: CONNTRACK_MAX / 8; max: CONNTRACK_MAX / 2
MODULES="ip_tables iptable_nat nf_nat_ftp nf_nat_irc nf_conntrack nf_conntrack_ftp nf_conntrack_irc ipt_MASQUERADE"
# The path in which the script is running
CURRENTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
LOG="LOG --log-level debug --log-tcp-sequence --log-tcp-options"
RLIMIT="-m limit --limit 3/sec --limit-burst 8"
export IPTABLES MODPROBE INET_IFACE INET_IP LAN_IFACE LAN_IP HTTP_SERVER FTP_SERVER DNS_SERVER




##############################################
# Please set the port you need to open here  #
##############################################
# input udp all
INPUT_SERVICES_UDP_ALL="53 67 1194"
# input tcp all
INPUT_SERVICES_TCP_ALL="21 22 53 80 443"
# input udp internal
INPUT_SERVICES_UDP_INTERNAL="53 123 137 138"
# input tcp internal
INPUT_SERVICES_TCP_INTERNAL="21 22 80 139 445"
# output udp all dport
OUTPUT_SERVICES_UDP_ALL_DPORT="53 67 68 123 443 1194"
# output tcp all dport
OUTPUT_SERVICES_TCP_ALL_DPORT="21 22 53 80 443"
OUTPUT_SERVICES_TCP_ALL_DPORT_FTP=""
# output udp all sport
OUTPUT_SERVICES_UDP_ALL_SPORT=""
# output tcp all sport
OUTPUT_SERVICES_TCP_ALL_SPORT=""
OUTPUT_SERVICES_TCP_ALL_SPORT_FTP=""
# output udp internal
OUTPUT_SERVICES_UDP_INTERNAL="53"
# output tcp internal
OUTPUT_SERVICES_TCP_INTERNAL="80 443"
# forward udp internal
FORWARD_SERVICES_UDP_INTERNAL="53 123"
# forward tcp internal
FORWARD_SERVICES_TCP_INTERNAL="21 22 53 80 443"


######################## NETWORK_AND_INTERFACE############################
# Sub net pattern,e.g. 192.168.1.0/24
SUBNET_PATTERN="((\<1?[0-9][0-9]?\>|\<2[0-4][0-9]\>|\<25[0-5]\>)\.){3}(\<1?[0-9][0-9]?\>|\<2[0-4][0-9]\>|\<25[0-5]\>)/(\<[1-2]{1,2}\>|\<2[3-9]\>|\<3[0-2]\>)"
# Get the default network interface
if [[ $DEFAULT_INTERFACE == "" ]];then
   DEFAULT_INTERFACE=$(ip route | grep default.* | sed '1!d' | grep -Po '(?<=dev\s)\w+')
   if [[ $DEFAULT_INTERFACE == "" ]];then
      export PS3="No default network interface present, please select it: "
      select DEFAULT_INTERFACE in ""$(ls /sys/class/net/ | sort --version-sort -f)""
      do
         echo You selected default network interface: "$DEFAULT_INTERFACE".
         echo ""
         break
      done
   fi
   if [[ $DEFAULT_INTERFACE == "" ]];then
      echo "No valid default interface selected, exiting..."
      exit 1
   fi
fi


# Get default network IP and its subnet
if [[ $SUBNET_ONLINE == "" ]];then
   INT_IP_ONLINE="$(ip -o -4 addr list $DEFAULT_INTERFACE | awk '{print $4}' | cut -d/ -f1)"
   #echo INT_IP_ONLINE: $INT_IP_ONLINE
   DEFAULT_SUBNET="$(ip route|grep $DEFAULT_INTERFACE|grep -v "default.*"|awk -F' ' '{print $1}')"
   if [[ $DEFAULT_SUBNET == "" ]];then
      read -r -p "No local network connection, please enter your subnet like this xxx.xxx.xxx.xxx/mask, e.g. 192.168.1.0/24: " DEFAULT_SUBNET
      if echo "$DEFAULT_SUBNET" | egrep -o $SUBNET_PATTERN > /dev/null 2>&1 ;then
            SUBNET_ONLINE=$DEFAULT_SUBNET
      else
         echo "No valid subnet entered, exiting..."
         exit 1
      fi
   else
      SUBNET_ONLINE=$DEFAULT_SUBNET
   fi
#echo SUBNET_ONLINE is $SUBNET_ONLINE
fi


# Get the virtual network IP and its subnet
if [[ $TUN_SUBNET0 == "" ]] ;then
   TUN0=tun0
   if [[ ! $(ls -1 /sys/class/net/ | grep "$TUN0") == "" ]];then
      IP_TUN0=$(ip -o -4 addr list $TUN0 | awk '{print $4}' | cut -d/ -f1)
      #echo IP_TUN0 is $IP_TUN0
      TUN_SUBNET0=$(echo $(echo $IP_TUN0 | cut -d"." -f1-3).0)
      #echo TUN_SUBNET0 is $TUN_SUBNET0
   fi
fi


if [[ $TUN_SUBNET1 == "" ]];then
   TUN1=tun1
   if [[ ! $(ls -1 /sys/class/net/ | grep "$TUN1") == "" ]];then
      IP_TUN1=$(ip -o -4 addr list $TUN1 | awk '{print $4}' | cut -d/ -f1)
      #echo IP_TUN1 is $IP_TUN1
      TUN_SUBNET1=$(echo $(echo $IP_TUN1 | cut -d"." -f1-3).0)
      #echo TUN_SUBNET1 is $TUN_SUBNET1
   fi
fi


# variables
DEFAULT_CONNECTED_SUBNET="$SUBNET_ONLINE"
#echo "DEFAULT_CONNECTED_SUBNET:" $DEFAULT_CONNECTED_SUBNET
if [[ $TUN_SUBNET0 != "" ]]; then CONNECTED_TUN_SUBNET0="$TUN_SUBNET0/24"; else CONNECTED_TUN_SUBNET0=""; fi
if [[ $TUN_SUBNET1 != "" ]]; then CONNECTED_TUN_SUBNET1="$TUN_SUBNET1/24"; else CONNECTED_TUN_SUBNET1=""; fi
IPTABLES_TUN_SUBNETS=$(echo "$CONNECTED_TUN_SUBNET0 $CONNECTED_TUN_SUBNET1" | tr ' ' '\n' | cat)
#echo "IPTABLES_TUN_SUBNETS:" $IPTABLES_TUN_SUBNETS
IPTABLES_SUBNETS=$(ip route | egrep -v "169\.254\..*|default.*"|awk '{print $1}'|egrep -o ".*\/.*")
#echo "IPTABLES_SUBNETS:" $IPTABLES_SUBNETS
# Get internal interface
INTERNAL_INTERFACE="$(ip -o -4 addr list|awk -F' ' '{print $2}'|sed 's/[[:space:]]*$//g'|egrep -v "lo|$DEFAULT_INTERFACE|tun.*"|tr '\n' ' ')"
#echo "INTERNAL_INTERFACE:"$INTERNAL_INTERFACE
INTERNAL_SUBNET="$(ip route | egrep -v "169\.254\..*|default.*|$DEFAULT_INTERFACE|tun.*"|awk '{print $1}'|egrep -o ".*\/.*")"
#echo INTERNAL_SUBNET: $INTERNAL_SUBNET
######################## NETWORK_AND_INTERFACE############################




########################GLOBAL_PARAMETER_SETING_STOP######################






########################Load kernel modules start#########################
for mod in $MODULES
do
  testmod=`/sbin/lsmod | grep "^${mod} " | /bin/awk '{print $1}'`
  if [ "$testmod" = "" ]; then
    $MODPROBE $mod
  fi
done
########################Load kernel modules stop#########################


#######################Kernel configuration start########################
#Enable IP forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
#Prevent SYN Flood attacks
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "2048" > /proc/sys/net/ipv4/tcp_max_syn_backlog
echo "2" > /proc/sys/net/ipv4/tcp_synack_retries
#Conntrack parameters optimization
echo "${CONNTRACK_MAX}" > /proc/sys/net/netfilter/nf_conntrack_max
echo "${ESTAB_TIMEOUT}" > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established
echo "${TIME_WAIT}" > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_time_wait
echo "${CLOSE_WAIT}" > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_close_wait
echo "${FIN_WAIT}" > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_fin_wait
#Set hash table size
echo "${CONNTRACK_BUCKETS}" > /sys/module/nf_conntrack/parameters/hashsize
# Enable IP spoofing protection 
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i; done
# Don't accept or send ICMP redirects. 
for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $i; done
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $i; done
# Don't accept source routed packets. 
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $i; done
# Disable proxy_arp. 
for i in /proc/sys/net/ipv4/conf/*/proxy_arp; do echo 0 > $i; done
# Ignore ICMP echo requests to broadcast 
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Don't log invalid responses to broadcast 
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses


#######################Kernel configuration stop########################


#######################Set default policies start#######################
# Drop everything by default. 
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP


# Set the nat/mangle/raw tables' chains to ACCEPT 
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT


$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
#######################Set default policies stop#######################


#######################Clean tables start##############################
# Delete all 
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -t security -F
# Delete all 
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
$IPTABLES -t security -X
# Zero all packets and counters. 
$IPTABLES -Z
$IPTABLES -t nat -Z
$IPTABLES -t mangle -Z
#######################Clean tables stop###############################


#######################Disable ip6tables start#########################
# Block all IPv6 traffic 
# If the ip6tables command is available, try to block all IPv6 traffic. 
if test -x $IP6TABLES; then
# Set the default policies 
# drop everything 
$IP6TABLES -P INPUT DROP &>/dev/null
$IP6TABLES -P FORWARD DROP &>/dev/null
$IP6TABLES -P OUTPUT DROP &>/dev/null


# The mangle table can pass everything 
$IP6TABLES -t mangle -P PREROUTING ACCEPT &>/dev/null
$IP6TABLES -t mangle -P INPUT ACCEPT &>/dev/null
$IP6TABLES -t mangle -P FORWARD ACCEPT &>/dev/null
$IP6TABLES -t mangle -P OUTPUT ACCEPT &>/dev/null
$IP6TABLES -t mangle -P POSTROUTING ACCEPT &>/dev/null


# Delete all rules. 
$IP6TABLES -F &>/dev/null
$IP6TABLES -t mangle -F &>/dev/null


# Delete all chains. 
$IP6TABLES -X &>/dev/null
$IP6TABLES -t mangle -X &>/dev/null


# Zero all packets and counters. 
$IP6TABLES -Z &>/dev/null
$IP6TABLES -t mangle -Z &>/dev/null
fi
#######################Disable ip6tables start#########################




#######################USER_DEFINED_CHAIN##############################
# Custom user-defined chains.


# LOG packets, then ACCEPT. 
$IPTABLES -N accept_log
$IPTABLES -A accept_log -j $LOG $RLIMIT --log-prefix "ACCEPT "
$IPTABLES -A accept_log -j ACCEPT
$IPTABLES -A accept_log -p ALL -j RETURN


# LOG packets, then DROP. 
$IPTABLES -N drop_log
$IPTABLES -A drop_log -j $LOG $RLIMIT --log-prefix "DROP "
$IPTABLES -A drop_log -j DROP
$IPTABLES -A drop_log -p ALL -j RETURN


### security
# port scanning
$IPTABLES -N port_scanning
$IPTABLES -A port_scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j DROP
$IPTABLES -A port_scanning -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A port_scanning -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A port_scanning -d 255.255.255.255 -p icmp -j DROP
$IPTABLES -A port_scanning -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A port_scanning -j RETURN


### Limit RST packets ### 
$IPTABLES -N limit_rst
$IPTABLES -A limit_rst -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
$IPTABLES -A limit_rst -p tcp --tcp-flags RST RST -j DROP
$IPTABLES -A limit_rst -p tcp -j RETURN


# ddos
# 50/m  200
# 60/s  20
$IPTABLES -N ddos
### Limit new TCP connections per second per source IP ### 
$IPTABLES -A ddos -p tcp -m connlimit --connlimit-above 111 -j DROP
$IPTABLES -A ddos -f -m limit --limit 100/sec --limit-burst 100 -j ACCEPT
$IPTABLES -A ddos -j RETURN


# syn flood tcp
##      1/s             -
#       1/s             3
#       5/s             10
$IPTABLES -N synflood_tcp
$IPTABLES -A synflood_tcp -p tcp -m conntrack --ctstate NEW -m limit --limit 3/s --limit-burst 6 -j RETURN
$IPTABLES -A synflood_tcp -p tcp -m conntrack --ctstate NEW -j DROP
$IPTABLES -A synflood_tcp -p tcp -j RETURN


# syn flood udp
$IPTABLES -N synflood_udp
$IPTABLES -A synflood_udp -p udp -m limit --limit 3/s --limit-burst 5 -j RETURN
$IPTABLES -A synflood_udp -p udp -j DROP
$IPTABLES -A synflood_udp -p udp -j RETURN




# ssh limits
$IPTABLES -N ssh_limits
# limiting ssh connections, drop all requests that are more than --hitcount x tries within --seconds y
# if ssh port is closed, packages are sent to input_log_reject if not matching the spefcified criteria, after that they are dropped without log
$IPTABLES -A ssh_limits -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
$IPTABLES -A ssh_limits -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
$IPTABLES -A ssh_limits -p tcp --dport 22 -m connlimit --connlimit-above 5 -j DROP
$IPTABLES -A ssh_limits -p tcp --dport 22 -j RETURN


# ping limits
$IPTABLES -N icmp_limits
$IPTABLES -A icmp_limits -p icmp --icmp-type 8 -m limit --limit 1/sec --limit-burst 2 -j accept_log
$IPTABLES -A icmp_limits -p icmp --icmp-type 8 -m connlimit ! --connlimit-above 3 -j accept_log
# drop all fragmented ICMP packets (almost always malicious). 
$IPTABLES -A icmp_limits -p icmp -f -j drop_log
$IPTABLES -A icmp_limits -j RETURN


services_all() {
if [ "$2" != "" ];then
   for port in $2
   do
      $IPTABLES -A $1 -p $3 $4 $port -j ACCEPT
   done
fi
}


### services input all
$IPTABLES -N input_services_all
services_all input_services_all "$INPUT_SERVICES_TCP_ALL" tcp --dport
services_all input_services_all "$INPUT_SERVICES_UDP_ALL" udp --dport
# leaving table "input_services_all"
$IPTABLES -A input_services_all -p ALL -j RETURN


### services output all
$IPTABLES -N output_services_all
services_all output_services_all "$OUTPUT_SERVICES_TCP_ALL_DPORT" tcp --dport
services_all output_services_all "$OUTPUT_SERVICES_UDP_ALL_DPORT" udp --dport
services_all output_services_all "$OUTPUT_SERVICES_TCP_ALL_SPORT" tcp --sport
services_all output_services_all "$OUTPUT_SERVICES_UDP_ALL_SPORT" udp --sport
#$IPTABLES -A output_services_all -p tcp --sport $OUTPUT_SERVICES_TCP_ALL_SPORT_FTP --dport $OUTPUT_SERVICES_TCP_ALL_DPORT_FTP -j ACCEPT
# leaving table "output_services_all"
$IPTABLES -A output_services_all -p ALL -j RETURN


services_internal() {
if [ "$IPTABLES_SUBNETS" != "" ];then
   for i in $IPTABLES_SUBNETS;
   do
      if [ "$i" != "" ];then
         if [ "$2" != "" ];then
            for port in $2
            do
               iptables -A $1 -p tcp -s $i $4 $port -j ACCEPT
            done
         fi
         if [ "$3" != "" ];then
            for port in $3
            do
               # for udp connections allow specified port
               iptables -A $1 -p udp -s $i $4 $port -j ACCEPT
            done
         fi
      else
         echo 'No entry for $i, skipping setting internal input port openings...'
      fi
   done
fi
}


if [ "$IPTABLES_SUBNETS" != "" ];then
   iptables -N input_services_internal
   services_internal input_services_internal "$INPUT_SERVICES_TCP_INTERNAL" "$INPUT_SERVICES_UDP_INTERNAL" --dport
   # leaving table "input_services_internal"
   iptables -A input_services_internal -p ALL -j RETURN


   iptables -N output_services_internal
   services_internal output_services_internal "$OUTPUT_SERVICES_TCP_INTERNAL" "$OUTPUT_SERVICES_UDP_INTERNAL" --dport
   iptables -A output_services_internal -p ALL -j RETURN


   iptables -N forward_services_internal
   services_internal forward_services_internal "$FORWARD_SERVICES_TCP_INTERNAL" "$FORWARD_SERVICES_UDP_INTERNAL" --dport
   iptables -A forward_services_internal -p ALL -j RETURN
fi
#
#######################User defined chains stop######################




### prerouting


### Drop invalid packets ### 
$IPTABLES -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
### Drop TCP packets that are new and are not SYN ### 
$IPTABLES -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
### Drop SYN packets with suspicious MSS value ### 
$IPTABLES -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
### Block packets with bogus TCP flags ### 
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
### Block spoofed packets ### 
$IPTABLES -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
$IPTABLES -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
#$IPTABLES -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
$IPTABLES -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
#$IPTABLES -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
#$IPTABLES -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
$IPTABLES -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
$IPTABLES -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
$IPTABLES -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
### Drop ICMP (you usually don't need this protocol) ### 
#$IPTABLES -t mangle -A PREROUTING -p icmp -j DROP
### Drop fragments in all chains ### 
$IPTABLES -t mangle -A PREROUTING -f -j DROP


#######################INPUT_RULES_START###############################
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# broadcast
$IPTABLES -A INPUT -m pkttype --pkt-type broadcast -j DROP
# muticast
$IPTABLES -A INPUT -m pkttype --pkt-type multicast -j DROP
$IPTABLES -A INPUT -j port_scanning 
$IPTABLES -A INPUT -j limit_rst
$IPTABLES -A INPUT -j ddos
$IPTABLES -A INPUT -j synflood_tcp
$IPTABLES -A INPUT -j synflood_udp
$IPTABLES -A INPUT -j icmp_limits
$IPTABLES -A INPUT -j ssh_limits
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -p ALL -j input_services_all
$IPTABLES -A INPUT -p ALL -j input_services_internal
# Allow incoming connections related to existing allowed connections. 
# Explicitly drop invalid incoming traffic 
$IPTABLES -A INPUT -m state --state INVALID -j DROP


#Start the extra firewall script module 
if [ -f $CURRENTDIR/iptables.deny ]; then
  sh $CURRENTDIR/iptables.deny
fi
if [ -f $CURRENTDIR/iptables.allow ]; then
  sh $CURRENTDIR/iptables.allow
fi
if [ -f $CURRENTDIR/iptables.http ]; then
  sh $CURRENTDIR/iptables.http
fi
# Use DROP instead of drop_log if you don't need logging.
$IPTABLES -A INPUT -j drop_log
#######################INPUT_RULES_STOP################################


#######################OUTPUT_RULES_START##############################
# Allow outgoing connections EXCEPT invalid 
$IPTABLES -A OUTPUT -p icmp -f -j drop_log
$IPTABLES -A OUTPUT -o lo -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
# Drop invalid outgoing traffic, too. 
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP
### sending packages through tables
$IPTABLES -A OUTPUT -p ALL -j output_services_all
$IPTABLES -A OUTPUT -p ALL -j output_services_internal
$IPTABLES -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -j drop_log


#######################OUTPUT_RULES_STOP##############################


######################FORWARD_RULES_START#############################
$IPTABLES -A FORWARD -j port_scanning
$IPTABLES -A FORWARD -j limit_rst
$IPTABLES -A FORWARD -j ddos
$IPTABLES -A FORWARD -j synflood_tcp
$IPTABLES -A FORWARD -j synflood_udp
$IPTABLES -A FORWARD -j icmp_limits
$IPTABLES -A FORWARD -j ssh_limits
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
### sending packages through custom chains
$IPTABLES -A FORWARD -p ALL -j forward_services_internal
### openvpn tun routing
if [ "$IPTABLES_TUN_SUBNETS" != "" ];then
   for i in $IPTABLES_TUN_SUBNETS
   do
      if [ "$i" != "" ];then
         # variable not empty
         if [ $i == "$CONNECTED_TUN_SUBNET0" ]; then TUNINTERFACE="$TUN0"; elif [ $i == "$CONNECTED_TUN_SUBNET1" ]; then TUNINTERFACE="$TUN1"; else :; fi
            #echo "Configuring openvpn $TUNINTERFACE for $i"
            iptables -I FORWARD -i $TUNINTERFACE -s $i -m conntrack --ctstate NEW -j ACCEPT
            iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            iptables -I FORWARD -i $TUNINTERFACE -o $DEFAULT_INTERFACE -s $i -d $DEFAULT_CONNECTED_SUBNET -m conntrack --ctstate NEW -j ACCEPT
            iptables -t nat -A POSTROUTING -s $i -j MASQUERADE
      else
            # variable empty
            echo 'No entry for $i, skipping openvpn tun configuration...'
      fi
   done
fi
$IPTABLES -A FORWARD -j drop_log


######################FORWARD_RULES_STOP#############################


#######################NAT_RULES_START###############################


if [ $INTERNAL_MASQUERADE_SWITCH -eq 1 ];then
   if [ "$INTERNAL_SUBNET" != "" ];then
      for net in $INTERNAL_SUBNET
      do
         $IPTABLES -t nat -A POSTROUTING -s $net ! -d $net -j MASQUERADE
      done
   
   fi
if [ $INTERNAL_DNAT_SWITCH -eq 1 ];then
   if [ "$INT_IP_ONLINE" != "" ];then     
      $IPTABLES -t nat -A PREROUTING -d $INT_IP_ONLINE -p tcp --dport 21 -j DNAT --to-destination ${FTP_SERVER}:21
      #$IPTABLES -t nat -A PREROUTING -d $INT_IP_ONLINE -p tcp --dport 80 -j DNAT --to-destination ${HTTP_SERVER}:80
   fi
fi
fi
#######################NAT_RULES_STOP################################


竹门迎日照
关注
DDos攻击生产案例脚本
Thorne_lu的博客
07-14 809
文章目录前言问题描述思路脚本后记 前言 问题描述 写一个脚本解决DOS攻击生产案例： ==提示：==根据web日志或者网络连接数，监控当某个IP并发连接数或者短时内PV达到100，立即调用防火墙命令封掉对应的IP，监控频率每隔3分钟。 防火墙命令为：iptables -I INPUT -s （源ip地址） -j DROP 思路 取到ip和ip访问次数 统计ip访问次数是否大于100次 判断出来后设置防火墙命令，并查看是否执行成功 脚本 后记 ...
linux搭建ddos发包机脚本_Linux下DDOS简单防御shell脚本
weixin_39707725的博客
12-30 4357
Linux下DDOS简单防御shell脚本注意：网站如果使用CDN的话，不可用这个，不然当网站IP连接数过高，会把CDN的IP拉黑连接数限制为200，需要添加crontab定时任务，脚本10S运行一次，iptables每小时flush一次,并且会发送到你的邮箱.这个脚本检测的是80/443端口，如有其他需要，可以更改前两行grep -E "XXXX"规则运行日志保存到run.log,黑名单保存在b...
Linux iptables防火墙详解防止DDOS
06-21
Linux iptables防火墙详解防止DDOS
linux防ddos攻击脚本,Linux IPTables防DDOS攻击Shell脚本
weixin_42365510的博客
05-01 428
1、Shell脚本#!/bin/bash/bin/netstat -na |grep ESTABLISHED |awk ‘{print $5}’ |awk -F : ‘{print $1}’ | sed ‘/^$/d’ |sort|uniq -c|sort -rn|head -n 10|grep -v -E ’192.168|127.0′ |sed ‘/^$/d’ |awk ‘{if ($2!=n...
使用 IPtables 进行 DDoS 保护
allway2的博客
07-28 3297
有多种方法可以为 iptables 构建自己的反 DDoS 规则。我们将在本综合教程中讨论最有效的 iptables DDoS 保护方法。本指南将教您如何：请注意，本文是为每天与 Linux 服务器打交道的专业人士编写的。如果您只想保护您的在线应用程序免受 DDoS 攻击，您可以使用我们的远程保护、具有 DDoS 保护的 VPS 或受 DDoS 保护的裸机服务器。虽然使用 iptables 可以做很多事情来阻止 DDoS 攻击，但没有办法绕过实际的硬件防火墙（我们最近审查了 RioRey DDoS 缓解硬件
利用iptables防止DDOS***。
weixin_34186128的博客
12-28 132
获取httpd日志1分钟内连续访问网站达100次ip，将其加入iptables中。此脚本只做简单分析。#!/bin/bash ############################################## #Author:LIYUNQING-liyunqing113@126.com #QQ:332841772 #Lastmodified:2016-12...
用Iptables抵御DDOS
欢迎你来到飞扬博客
06-09 149
用Iptables抵御DDOS iptables -A INPUT  -p tcp --syn -m limit --limit 12/s --limit-burst 24 -j ACCEPT iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables防cc/ddos脚本
08-26
脚本原理：自动检查tcp链接数，超过设定阈值后，自动drop该ip流量。
DDOS攻击类型以及iptables防范ddos脚本.docx
10-29
DDOS攻击类型以及iptables防范DDOS脚本 一、DDOS攻击类型 DDOS攻击（Distributed Denial of Service）是一种常见的网络攻击方式，攻击者通过大量的网络请求使得被攻击方的服务器或网络资源不堪重负，导致服务中断...
linux 抗ddos脚本写法
最新发布
07-12
编写一个Linux抗DDoS脚本并不是一个简单的任务，因为DDoS攻击的类型和方式各不相同，需要综合考虑多个因素来进行防御。以下是一些常见的抗DDoS脚本编写思路： 1. 防火墙规则：使用iptables或其他防火墙工具，配置...
防cc攻击脚本配合iptables
12-21
linux上防cc攻击，本脚本配置iptables使用，安装cckiller -i，卸载cckiller -U
iptables防御DDOS***
weixin_34370347的博客
03-14 153
SYN***是利用TCP/IP协议3次握手的原理，发送大量的建立连接的网络包，但不实际建立连接，最终导致被***服务器的网络队列被占满，无法被正常用户访问。SYN Flood***虽然原理简单,但是造成的危害却十分严重。防范DDOS***脚本#防止SYN*** 轻量级预防iptables -N syn-flood iptables -A INPUT -p tcp --syn ...
轻量级防范DDOS攻击脚本
root9527
03-31 1355
防止SYN攻击 轻量级预防 iptables -N syn-flood iptables -A INPUT -p tcp --syn -j syn-flood iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN iptables -A syn-flood -j REJECT 防止DOS...
Linux 防ddos攻击脚本 (D)DoS-Deflate
tyb125002875的专栏
03-22 1829
最近服务器遭遇ddos攻击，搜索一些缓解的方法。1、对sysctl参数进行修改$ sudo sysctl -a  | grep ipv4 | grep syn输出类似下面：net.ipv4.tcp_max_syn_backlog = 1024net.ipv4.tcp_syncookies = 0net.ipv4.tcp_synack_retries = 5net.ipv4.tcp_syn_retries = 5* net.ipv4.tcp_syncookies是是否打开SYN COOKIES的功能，“1”为
iptables 防护基本 DDoS 配置
奋斗中拥有
01-24 2493
iptables 防护基本 DDoS 配置 Kernel Anti-DDoS 参数设置 (sysctl.conf) kernel.printk = 4 4 1 7 kernel.panic = 10 kernel.sysrq = 0 kernel.shmmax = 4294967296 kernel.shmall = 4194304 kernel.core_uses_pid
经典好用anti-DDos的iptables shell脚本
weixin_33878457的博客
09-18 363
#!/bin/bash# Description: This script applies to both RHEL and CentOS systems.This is# a powerful firewall, anti DDOS attacks, and not limitedto this, you can# make your Linux server as ro...
iptables防止ddos
weixin_43820206的博客
05-11 913
参考https://blog.51cto.com/huangzp/1896586 使用ab工具模拟ddos攻击 说明：ab是做压力测试的工具 安装ab： yum install -y httpd-tools 格式：ab -n 连接总数 -c 并发客户端数 网站 ddos攻击检测方法： 方法一：用脚本检查是否有ddos攻击方法 netstat -ntu | awk ‘{print $5}’ | ...
iptables防护ddos***规则
weixin_34342578的博客
03-21 819
转自https://czmmiao.iteye.com/blog/1616837 前言 虚拟主机服务商在运营过程中可能会受到******，常见的***方式有SYN，DDOS等。通过更换IP，查找被***的站点可能避开***，但是中断服务的时间比较长。比较彻底的解决方法是添置硬件防火墙。不过，硬件防火墙价格比较昂贵。可以考虑利用Linux 系统本身提供的防火墙功能来防御。SYN***是利用TCP/...
iptables防DDOS攻击和CC攻击设置
亘优科技
08-09 974
防范DDOS攻击脚本 #防止SYN攻击 轻量级预防  iptables -N syn-flood  iptables -A INPUT -p tcp --syn -j syn-flood  iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN  iptables -A syn-flood
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值