linux iptables防攻击配置

iptables -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT

#处理IP碎片数量,防止攻击,允许每秒100个

iptables -A FORWARD -f -m limit --limit 100/sec --limit-burst 100 -j ACCEPT

#设置ICMP包过滤,允许每秒1个包,限制触发条件是10个包.

iptables -A FORWARD -p icmp -m limit --limit 1/sec --limit-burst 10 -j ACCEPT

iptables -A FORWARD -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT

#Ping洪水攻击

iptables -A FORWARD -p icmp -m icmp --icmp-type echo-request -m limit --limit 1/sec -j ACCEPT

iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT