用iptables来缓解web服务器被DDOS和CC攻击

32rwe111

[iyunv@i-d99cdn63 ~]# vi /etc/iptables_settings.sh
[iyunv@i-d99cdn63 ~]# more /etc/iptables_settings.sh
#!/bin/sh -e
#----------------------------------------------------------
# iptables settings
#----------------------------------------------------------
#Connection IP address
SSH_IP1="192.168.0.0/16"
SNMP_IP1="192.168.0.0/16"
#----------------------Standard part---------------------------
# Stop iptables service first
#service iptables stop
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z
# Inital chains default policy
/sbin/iptables -F -t filter
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
# Enable Native Network Transfer
/sbin/iptables -A INPUT -i lo -j ACCEPT
# DROP DDOS ip Address
/sbin/iptables -N DROP_WEB
/sbin/iptables -I INPUT -j DROP_WEB
# ICMP Control
/sbin/iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
# SSH Service
/sbin/iptables -A INPUT -s $SSH_IP1 -p tcp --dport 22 -j ACCEPT
# SNMP Service
/sbin/iptables -A INPUT -s $SNMP_IP1 -p udp --dport 161 -j ACCEPT
#-----------------------Custom part-----------------------
# jiangkongbao Service
/sbin/iptables -A INPUT -s 61.150.91.55 -j ACCEPT
/sbin/iptables -A INPUT -s 61.150.91.223  -j ACCEPT
/sbin/iptables -A INPUT -s 61.150.91.224 -j ACCEPT
/sbin/iptables -A INPUT -s 218.60.34.94  -j ACCEPT
/sbin/iptables -A INPUT -s 218.60.34.93 -j ACCEPT
/sbin/iptables -A INPUT -s 61.164.109.58  -j ACCEPT
/sbin/iptables -A INPUT -s 115.230.127.77 -j ACCEPT
/sbin/iptables -A INPUT -s 124.133.28.7  -j ACCEPT
/sbin/iptables -A INPUT -s 60.208.37.146  -j ACCEPT
/sbin/iptables -A INPUT -s 119.188.112.227 -j ACCEPT
/sbin/iptables -A INPUT -s 140.206.173.159  -j ACCEPT
/sbin/iptables -A INPUT -s 140.206.173.222 -j ACCEPT
/sbin/iptables -A INPUT -s 124.232.150.171 -j ACCEPT
/sbin/iptables -A INPUT -s 114.80.201.18  -j ACCEPT
/sbin/iptables -A INPUT -s 180.169.22.226 -j ACCEPT
/sbin/iptables -A INPUT -s 174.136.4.8 -j ACCEPT
/sbin/iptables -A INPUT -s 210.200.216.145 -j ACCEPT
/sbin/iptables -A INPUT -s 106.187.47.224 -j ACCEPT
/sbin/iptables -A INPUT -s 58.215.186.208 -j ACCEPT
/sbin/iptables -A INPUT -s 59.53.63.61 -j ACCEPT
# Accept Established Connections
##(1)控制单个IP的最大并发连接数
/sbin/iptables -A INPUT -p tcp --dport 80 -m connlimit  --connlimit-above 100 -j REJECT
##(2)控制单个IP在一定的时间(比如6秒)内允许新建立的连接数（比如20个），超过部分记入log，log标记为DDOS
/sbin/iptables -A INPUT -p tcp  --syn -m recent --name webpool --rcheck --seconds 6 --hitcount 20 -j LOG --log-level 5 --log-prefix 'DDOS:' --log-ip-options
/sbin/iptables -A INPUT -p tcp  --syn -m recent --name webpool --rcheck --seconds 6 --hitcount 20 -j DROP
/sbin/iptables -A INPUT -p tcp  --syn -m recent --name webpool --set -j ACCEPT
##(3)保持已建立的会话
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#deny all Service
/sbin/iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
/sbin/iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
[iyunv@i-d99cdn63 ~]#
[iyunv@i-d99cdn63 ~]# chkconfig iptables off
[iyunv@i-d99cdn63 ~]# /bin/sh /etc/iptables_settings.sh
[iyunv@i-d99cdn63 ~]# echo "/bin/sh /etc/iptables_settings.sh" >>  /etc/rc.local
[iyunv@i-d99cdn63 ~]# more /etc/rsyslog.conf
添加如下一行
#kern.*                                                 /dev/console
kern.=notice                                            /var/log/ddos.log
[iyunv@i-d99cdn63 ~]# service rsyslog restart
[iyunv@i-d99cdn63 ~]# more /var/log/ddos.log