On Sun, 28 Feb 2010 10:19:03 +0100 Mart Frauenlob <mart.frauenlob@xxxxxxxxx> wrote: > On 27.02.2010 06:36, netfilter-owner@xxxxxxxxxxxxxxx wrote: > > iptables -A INPUT -j DROP . > > iptables -A OUTPUT -j ACCEPT > > > > When i syn flooded my desktop . I can see all pkts are getting > > rejected by the rule . But system becomes slow beacuse of this . Is > > there any way to make system fast ? will black listing will help ? > > > I use the following [..........] # Check hashlimit-htable-expire after 5 min ( 300000 mili second ) iptables -N syn-flood iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood iptables -A syn-flood -p tcp --syn -m hashlimit \ --hashlimit 200/sec --hashlimit-burst 3 --hashlimit-htable-expire 300000 \ --hashlimit-mode srcip --hashlimit-name testlimit -j RETURN # Drop bad IP and put then in blacklist iptables -A syn-flood -m recent --name blacklist --set -j DROP iptables -A INPUT -j syn-flood [.....] This rule should come after all your incoming rules. This rule is also effective against apache benchmark attack and ping flood also. regards -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
