iptables rules to counter the most common DoS attacks? [closed]

Solution 1:

Here are some rules I use:

# Reject spoofed packets
iptables -A INPUT -s 10.0.0.0/8 -j DROP
iptables -A INPUT -s 169.254.0.0/16 -j DROP
iptables -A INPUT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DROP

iptables -A INPUT -s 224.0.0.0/4 -j DROP
iptables -A INPUT -d 224.0.0.0/4 -j DROP
iptables -A INPUT -s 240.0.0.0/5 -j DROP
iptables -A INPUT -d 240.0.0.0/5 -j DROP
iptables -A INPUT -s 0.0.0.0/8 -j DROP
iptables -A INPUT -d 0.0.0.0/8 -j DROP
iptables -A INPUT -d 239.255.255.0/24 -j DROP
iptables -A INPUT -d 255.255.255.255 -j DROP

# Stop smurf attacks
iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp -m icmp -j DROP

# Drop all invalid packets
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP

# Drop excessive RST packets to avoid smurf attacks
iptables -A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT

# Attempt to block portscans
# Anyone who tried to portscan us is locked out for an entire day.
iptables -A INPUT   -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP

# Once the day has passed, remove them from the portscan list
iptables -A INPUT   -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan --remove

# These rules add scanners to the portscan list, and log the attempt.
iptables -A INPUT   -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
iptables -A INPUT   -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

Solution 2:

So appreciate your bullet-proof rules.

You should contact your ISP and have the traffic dropped on the backbone before it hits you. If you're at the point where your firewall has to drop the traffic, then it's already consuming your available bandwidth and using your system's resources.

That's the only "bulletproof" way.

Solution 3:

I use IPtables in order to limit the access to FTP and SSH, I just allow my computer's IPs to connect to the server. I cannot say I had DOS attacks problems.

/sbin/iptables -A INPUT -p tcp --dport 22 -s 86.106.0.0/16 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 22 -s 89.122.0.0/16 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 22 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 21 -s 86.106.0.0/16 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 21 -s 89.122.0.0/16 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP

These rules allow access to ports 22 and 21 on two different IPs. You can probably add the MySQL port of your db server and that way block other clients from connecting directly to your server.

Edit: when server is overloaded I find it helpful to see Apache "mod-status" statistics, the output looks like this: http://www.apache.org/server-status you can see all site visitors , spiders, url requests, etc. Implementation takes under 1 minute: http://httpd.apache.org/docs/2.2/mod/mod_status.html

iptables rules to counter the most common DoS attacks? [closed]

Solution 1:

Solution 2:

Solution 3:

Related

Recent Posts