iptables

Discussion in 'AntiDDos - АнтиДДОС' started by BFenix, 17 Aug 2009.

  1. BFenix

    BFenix New Member

    Joined:
    17 Aug 2009
    Messages:
    7
    Likes Received:
    1
    Reputations:
    0
    Начал настраивать фаервол для защиты сервера. Апач забивают банальным флудом на 80 порт. Ботнет небольшой (до 1к машин), ну по крайней мере мне так сказал атакующий(оказался норм штрих, просто делает то за что ему платят деньги).

    Вот мой фаервол:

    Code:
    #!/bin/sh
EXT_DEV="eth2"
EXT_DEV_IP="ххх.ххх.ххх.ххх"

INT_DEV1="eth0"
INT_DEV1_IP="192.168.1.2"

INT_DEV2="eth1"
INT_DEV2_IP="192.168.2.2"

LO_DEV="lo"
LO_DEV_IP="127.0.0.1"

IPTABLES="/sbin/iptables"
## Needed to initially load modules
/sbin/depmod -a

# Required modules
/sbin/modprobe xt_connlimit
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_conntrack_amanda
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ipt_geoip

# Required proc configuration
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "3600" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/tcp_syn_retries
echo "1" > /proc/sys/net/ipv4/tcp_keepalive_probes
echo "2" > /proc/sys/net/ipv4/tcp_synack_retries

# flush all the rules in the filter and nat tables.
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

# erase all chains that's not default in filter and nat table.
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

# reset the default policies in the mangle table.
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT

# reset the default policies in the nat table.
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

# Set policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

# Create userspecified chains
$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
$IPTABLES -N bogons
$IPTABLES -N black_country
$IPTABLES -N ddos

#is open for test
$IPTABLES -A INPUT -p TCP -s 0/0 --dport 22222 -j ACCEPT

#bogons chain
for host in `cat /etc/sysconfig/ip.deny.bogons`; do
    $IPTABLES -A bogons -s $host -j DROP
done

#black.country chain
$IPTABLES -A black_country -m geoip --src-cc UA,RU,PL,BY,MD,NO,NL,LV,US,CA,DE,KZ,EE,GE,LT  -j ACCEPT
$IPTABLES -A black_country -m geoip --src-cc IL,IT,UZ,GB,ES,FR,AZ,CZ,CH,SE,RO,FI,AM,TR,AU  -j ACCEPT
$IPTABLES -A black_country -j DROP

# bad_tcp_packets chain
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m state --state INVALID -j DROP

# allowed chain
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP

# TCP rules
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 8080 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 53 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 443 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22222 -j allowed

# UDP chain
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 53 -j ACCEPT

# ICMP chain
$IPTABLES -A icmp_packets -p ICMP -d $EXT_DEV_IP --icmp-type echo-request -m limit --limit 5/s -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s $EXT_DEV_IP -d 0/0 --icmp-type 0 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s $EXT_DEV_IP  -d 0/0 --icmp-type 8 -j ACCEPT

# ddos chain
$IPTABLES -A ddos --dport 80 -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name DDOS --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-gcinterval 1000 --hashlimit-htable-expire 100000 -j ACCEPT
$IPTABLES -A ddos -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A ddos -j ACCEPT


#input
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state NEW,RELATED -j bogons
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state NEW,RELATED -j black_country
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -j ddos
$IPTABLES -A INPUT -p tcp -i $EXT_DEV -j bad_tcp_packets
$IPTABLES -A INPUT -p TCP -i $EXT_DEV -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $EXT_DEV -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $EXT_DEV -j icmp_packets

$IPTABLES -A INPUT -p ALL -i $INT_DEV1 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $INT_DEV2 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_DEV -j ACCEPT

#output
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

# Bad TCP packets we don't want.
#list banned IP in file ip.denny
for host in `cat /etc/sysconfig/ip.deny`; do
    $IPTABLES -A INPUT -s $host -i $EXT_DEV -j DROP
    $IPTABLES -A FORWARD -s $host  -i $EXT_DEV -j DROP
done

/sbin/iptables-save > /etc/sysconfig/iptables
    Апач ложится через 10 секунд после начала атаки.

    Если есть предложения по оптимизации, то готов выслушать.
     
    #1 BFenix, 17 Aug 2009
    Last edited: 17 Aug 2009
  2. PandoraBox

    PandoraBox Elder - Старейшина

    Joined:
    6 May 2007
    Messages:
    262
    Likes Received:
    176
    Reputations:
    7
    nginx в руки и вперед по настройкам Игоря Сысоева
     
    #2 PandoraBox, 17 Aug 2009
  3. ReduKToR

    ReduKToR Active Member

    Joined:
    5 Jan 2009
    Messages:
    257
    Likes Received:
    179
    Reputations:
    4
    #3 ReduKToR, 18 Aug 2009
    1 person likes this.
  4. BFenix

    BFenix New Member

    Joined:
    17 Aug 2009
    Messages:
    7
    Likes Received:
    1
    Reputations:
    0
    решил немного изменить вид цепочек. Пока внешний вид такой:
    Code:
    #!/bin/sh
EXT_DEV="eth2"
EXT_DEV_IP="ххх.ххх.ххх.ххх"

INT_DEV1="eth0"
INT_DEV1_IP="192.168.1.2"

INT_DEV2="eth1"
INT_DEV2_IP="192.168.2.2"

LO_DEV="lo"
LO_DEV_IP="127.0.0.1"

IPTABLES="/sbin/iptables"
## Needed to initially load modules
/sbin/depmod -a

# Required modules
/sbin/modprobe xt_connlimit
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_conntrack_amanda
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ipt_geoip

# Required proc configuration
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "3600" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/tcp_syn_retries
echo "1" > /proc/sys/net/ipv4/tcp_keepalive_probes
echo "2" > /proc/sys/net/ipv4/tcp_synack_retries

# flush all the rules in the filter and nat tables.
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

# erase all chains that's not default in filter and nat table.
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

# reset the default policies in the mangle table.
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT

# reset the default policies in the nat table.
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

# Set policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

#is open for test
$IPTABLES -A INPUT -p TCP -s 0/0 --dport 22222 -j ACCEPT

#bogons chain
$IPTABLES -N bogons
for host in `cat /etc/sysconfig/ip.deny.bogons`; do
    $IPTABLES -A bogons -s $host -j DROP
done

#list banned IP in file ip.deny
$IPTABLES -N black_ip
for host in `cat /etc/sysconfig/ip.deny`; do
    $IPTABLES -A black_ip -s $host -i $EXT_DEV -j DROP
done

# ICMP chain
$IPTABLES -N icmp_ddos
$IPTABLES -A icmp_ddos -p ICMP -m hashlimit --hashlimit-name icmp0 --hashlimit 2/s --hashlimit-mode srcip --icmp-type 0 -j ACCEPT
$IPTABLES -A icmp_ddos -p ICMP -m hashlimit --hashlimit-name icmp8 --hashlimit 2/s --hashlimit-mode srcip --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_ddos -p ICMP -m hashlimit --hashlimit-name icmp11 --hashlimit 2/s --hashlimit-mode srcip --icmp-type 11 -j ACCEPT
$IPTABLES -A icmp_ddos -j DROP

# udp_ddos chain
$IPTABLES -N udp_ddos
$IPTABLES -A udp_ddos -p UDP -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name udp_ddos -j ACCEPT
$IPTABLES -A udp_ddos -p UDP -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A udp_ddos -p UDP -j DROP

# http_ddos chain
$IPTABLES -N http_ddos
$IPTABLES -A http_ddos -p TCP -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name httpddos --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-gcinterval 1000 --hashlimit-htable-expire 100000 -j ACCEPT
$IPTABLES -A http_ddos -p TCP -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A http_ddos -p TCP -j DROP

# tcp_ddos chain
$IPTABLES -N tcp_ddos
$IPTABLES -A tcp_ddos -p TCP -m hashlimit --hashlimit 15/min --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name tcpddos --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-gcinterval 1000 --hashlimit-htable-expire 100000 -j ACCEPT
$IPTABLES -A tcp_ddos -p TCP -m connlimit --connlimit-above 15 -j DROP
$IPTABLES -A tcp_ddos -p TCP -j DROP

# syn_flood chain
$IPTABLES -N syn_flood
$IPTABLES -A syn_flood -m hashlimit --hashlimit 1/s --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name syn_flood -j ACCEPT

# bad_tcp_packets chain
$IPTABLES -N bad_tcp_packets
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A bad_tcp_packets -p tcp -m state --state INVALID -j DROP

#protocol_filter chain
$IPTABLES -N protocol_filter
$IPTABLES -A protocol_filter -p tcp -j bad_tcp_packets
$IPTABLES -A protocol_filter -p tcp -j syn_flood
$IPTABLES -A protocol_filter -p tcp -m multiport --dport 53,21,22222 -j tcp_ddos
$IPTABLES -A protocol_filter -p tcp -m multiport --dport 80,8080,443 -j http_ddos
$IPTABLES -A protocol_filter -p UDP --dport 53 -j udp_ddos
$IPTABLES -A protocol_filter -p ICMP -j icmp_ddos
$IPTABLES -A protocol_filter -j DROP

#black.country chain
$IPTABLES -N black_country
$IPTABLES -A black_country -m geoip --src-cc UA,RU,PL,BY,MD,NO,NL,LV,US,CA,DE,KZ,EE,GE,LT  -j protocol_filter
$IPTABLES -A black_country -m geoip --src-cc IL,IT,UZ,GB,ES,FR,AZ,CZ,CH,SE,RO,FI,AM,TR,AU  -j protocol_filter
$IPTABLES -A black_country -j DROP

#input
$IPTABLES -A INPUT -p ALL -i $INT_DEV1 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $INT_DEV2 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_DEV -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -j black_ip
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state NEW,RELATED -j bogons
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $EXT_DEV -m state --state NEW,RELATED -j black_country

/sbin/iptables-save > /etc/sysconfig/iptables
echo "Firewall started"[
     
    #4 BFenix, 18 Aug 2009
    Last edited: 18 Aug 2009
  5. BFenix

    BFenix New Member

    Joined:
    17 Aug 2009
    Messages:
    7
    Likes Received:
    1
    Reputations:
    0
    Этот фаервол + enginx вчера в тесте выдержали небольшой ддос с 70 машин.

    На сайте даже небыло никаких признаков нагрузки.

    Скиньте плиз ссылки на инфу по оптимизации апача.
     
    #5 BFenix, 19 Aug 2009
  6. ReduKToR

    ReduKToR Active Member

    Joined:
    5 Jan 2009
    Messages:
    257
    Likes Received:
    179
    Reputations:
    4
    #6 ReduKToR, 19 Aug 2009
  7. ReduKToR

    ReduKToR Active Member

    Joined:
    5 Jan 2009
    Messages:
    257
    Likes Received:
    179
    Reputations:
    4
    это очень мало..... восновном с таким кол-вом ботов никто даже соваться небудет.....
     
    #7 ReduKToR, 19 Aug 2009
  8. BFenix

    BFenix New Member

    Joined:
    17 Aug 2009
    Messages:
    7
    Likes Received:
    1
    Reputations:
    0

    Я знаю, но раньше я и от этого числа ложился.

    З.Ы. Сенк за ссылки.

    З.З.Ы. кто-то из вас сможет меня потестить норм ботом?
     
    #8 BFenix, 19 Aug 2009
  9. ReduKToR

    ReduKToR Active Member

    Joined:
    5 Jan 2009
    Messages:
    257
    Likes Received:
    179
    Reputations:
    4
    небоишся что хостер выгонит? ну а по делу: стучи вечером, буду дома помогу....потестимс
     
    #9 ReduKToR, 19 Aug 2009
  10. ReduKToR

    ReduKToR Active Member

    Joined:
    5 Jan 2009
    Messages:
    257
    Likes Received:
    179
    Reputations:
    4
    ну а дальше уже блочим......
     
    #10 ReduKToR, 23 Aug 2009
  11. BFenix

    BFenix New Member

    Joined:
    17 Aug 2009
    Messages:
    7
    Likes Received:
    1
    Reputations:
    0

    PoM уже не актуален. Сейчас лучше юзать xtables
     
    #11 BFenix, 23 Aug 2009
  12. ReduKToR

    ReduKToR Active Member

    Joined:
    5 Jan 2009
    Messages:
    257
    Likes Received:
    179
    Reputations:
    4
    ну так я всеголиш ответил на вопрос,я неговорил что актуально,а что нет
     
    #12 ReduKToR, 24 Aug 2009
  13. BFenix

    BFenix New Member

    Joined:
    17 Aug 2009
    Messages:
    7
    Likes Received:
    1
    Reputations:
    0
    Есть кто-нить кто может для теста подосить?
     
    #13 BFenix, 28 Aug 2009
  14. [ STEF ]

    [ STEF ] Member

    Joined:
    19 Aug 2011
    Messages:
    69
    Likes Received:
    36
    Reputations:
    3
    Этот фаервол + enginx вчера в тесте выдержали небольшой ддос с 70 машин.

    На сайте даже небыло никаких признаков нагрузки.

    Скиньте плиз ссылки на инфу по оптимизации апача.
     
    #14 [ STEF ], 27 Aug 2011
  15. ShkiperLol

    ShkiperLol Banned

    Joined:
    17 Apr 2010
    Messages:
    182
    Likes Received:
    1
    Reputations:
    0
    дай сайт
     
    #15 ShkiperLol, 27 Aug 2011
(You must log in or sign up to post here.)
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.