Sử dụng Iptables chống Syn Flood attacks và cấm IP

# Limit the number of incoming tcp connections
# Interface 0 incoming syn-flood protection
iptables -N syn_flood
iptables -A INPUT -p tcp –syn -j syn_flood
iptables -A syn_flood -m limit –limit 1/s –limit-burst 3 -j RETURN
iptables -A syn_flood -j DROP

iptables -I INPUT -p tcp -s 0/0 -d $SERVER_IP –sport 513:65535 –dport 22 -m state –state NEW,ESTABLISHED -m recent –set -j ACCEPT iptables -I INPUT -p tcp –dport 22 -m state –state NEW -m recent –update –seconds 600 –hitcount 11 -j DROP
iptables -A OUTPUT -p tcp -s $SERVER_IP -d 0/0 –sport 22 –dport 513:65

#!/bin/bash
IPT=/sbin/iptables
SPAMLIST=”spamlist”
SPAMDROPMSG=”SPAM LIST DROP”
BADIPS=$(egrep -v -E “^#|^$” /root/iptables/blocked.ips)
# create a new iptables list
$IPT -N $SPAMLIST
for ipblock in $BADIPS
do
$IPT -A $SPAMLIST -s $ipblock -j LOG –log-prefix “$SPAMDROPMSG”
$IPT -A $SPAMLIST -s $ipblock -j DROP
done
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

#!/bin/bash
# Ban quyen thuoc ve Hanh_bk
/etc/init.d/iptables start
cd /root/iptables
netstat -atun | grep SYN_RECV | awk ‘{print $5}’ | cut -d: -f1 |sort | uniq -d | sort -n > blocked.ips
sh ./iptables.sh