iptables 过滤字符串

1. 开启iptables

iptables -P OUTPUT ACCEPT ###允许输出链

service iptables save ###保存规则

###切记注意执行顺序，防止自己被拒

2.设置开机自启动iptables

chkconfig iptables on

3.设置要禁止的字符串

iptables -A INPUT -m string --algo kmp --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" -j DROP

iptables -A INPUT -m string --algo bm --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" -j DROP

iptables -I INPUT -p all -s x.x.x.x -j DROP ###xxxx为IP

###”8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk”为要禁止的字符串

###iptables -t raw -A PREROUTING -p udp --dport 53 -m string --algo bm --hex-string "|对应域名的十六进制|" -j DROP 十六进制

4.保存规则

service iptables save

Erasing    : libvirt-devel-0.10.2-18.el6.i686                                                                                                  1/5
Erasing    : libvirt-java-devel-0.4.9-1.el6.noarch                                                                                             2/5
Erasing    : libvirt-java-0.4.9-1.el6.noarch                                                                                                   3/5
Erasing    : libvirt-client-0.10.2-18.el6.i686                                                                                                 4/5
Erasing    : nc-1.84-24.el6.i686                                                                                                               5/5
Verifying : libvirt-java-devel-0.4.9-1.el6.noarch                                                                                             1/5
Verifying : libvirt-devel-0.10.2-18.el6.i686                                                                                                  2/5
Verifying : nc-1.84-24.el6.i686                                                                                                               3/5
Verifying : libvirt-client-0.10.2-18.el6.i686                                                                                                 4/5
Verifying : libvirt-java-0.4.9-1.el6.noarch

yum -y install libvirt-devel-0.10.2-18.el6.i686 libvirt-java-devel-0.4.9-1.el6.noarch libvirt-java-0.4.9-1.el6.noarch libvirt-client-0.10.2-18.el6.i686

wget ftp://rpmfind.net/linux/Mandriva/official/2008.0/i586/media/main/release/nc-1.10-26mdv2008.0.i586.rpm

#ipatbles
iptables -I   INPUT   -p   all   -s 58.54.199.2   -j   DROP

####①-
-A INPUT -m string --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" --algo kmp --to 65535 -j DROP
-A INPUT -m string --string "NODPxbCNkzQSLLjXeaBJqhDGMytfHievkLZBVYgVOTuMdiIwkilyClCLnURJIpOkBYrbocDAweGpUAxaU" --algo kmp --to 65535 -j DROP
-A INPUT -m string --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" --algo bm --to 65535 -j DROP
-A INPUT -m string --string "NODPxbCNkzQSLLjXeaBJqhDGMytfHievkLZBVYgVOTuMdiIwkilyClCLnURJIpOkBYrbocDAweGpUAxaU" --algo bm --to 65535 -j DROP

####②-SYN_RECV

iptables -N syn-flood

iptables -A INPUT -p tcp --syn -j syn-flood

iptables -A syn-flood -p tcp -m limit --limit 2/s --limit-burst 50 -j RETURN

iptables -A syn-flood -j DROP

###③-MZ1{S@MZ1{S@

iptables -A INPUT -m string --string "MZ1{S@MZ1{S@" --algo kmp --to 65535 -j DROP
iptables -A INPUT -m string --string "MZ1{S@MZ1{S@" --algo bm --to 65535 -j DROP

218.85.139.248 9977

iptables -N syn-flood
iptables -A FORWARD -p tcp --syn -j syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -A syn-flood -p tcp --syn -m limit --limit 3/s --limit-burst 1 -j ACCEPT
iptables -A syn-flood -j DROP
iptables -A INPUT -i eth4 -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp --syn -m state --state NEW -j DROP

iptables -A INPUT -p tcp --dport 10000 -m recent --name BAD_HTTP_ACCESS --update --seconds 60 --hitcount 30 -j REJECT
iptables -A INPUT -p tcp --dport 10000 -m recent --name BAD_HTTP_ACCESS --set -j ACCEPT

iptables -A INPUT -m string --algo bm --hex-string "|00 00 25 9a 00 00 00 00 00 00 00 00|" -j DROP
iptables -A INPUT -m string --algo kmp --hex-string "|00 00 25 9a 00 00 00 00 00 00 00 00|" -j DROP