Linux iptables 安全配置(防Ddos)

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-N whitelist
-A whitelist -s 58.60.2.91 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j whitelist
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 29666 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 27481 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 29888 -j ACCEPT
#防止syn攻击（DDOOS攻击的一种）
-A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#防止各种端口扫描
-A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#Ping洪水攻击（Ping of Death）
-A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT