linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip :

netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -nr

now i want add all ip addresses that made more than 200 requests into IPtables to DROP input and out put.

Solution 1:

Well you can not prevent ddos, and 200 requests is rather trivial.

Best you can do , IMO, is to set limits

sudo iptables -A INPUT -m limit --limit 50/minute --limit-burst 200 -j ACCEPT
sudo iptables -A INPUT -j REJECT

For port 80, use

sudo iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT
sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT
sudo iptables -A INPUT -j REJECT

You should be able to adjust those limits to your server.

See: http://blog.bodhizazen.com/linux/prevent-dos-with-iptables/