Linux服务器下对SYN洪水攻击的诊断和阻挡

# tail -f /var/log/messages
Apr 18 11:21:56 web5 kernel: possible SYN flooding on port 80. Sending cookies.

# stat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'
TIME_WAIT 16855
CLOSE_WAIT 21
SYN_SENT 99
FIN_WAIT1 229
FIN_WAIT2 113
ESTABLISHED 8358
SYN_RECV 48965
CLOSING 3
LAST_ACK 313

# stat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'
TIME_WAIT 42349
CLOSE_WAIT 1
SYN_SENT 4
FIN_WAIT1 298
FIN_WAIT2 33
ESTABLISHED 12775
SYN_RECV 259
CLOSING 6
LAST_ACK 432

#缩短SYN- Timeout时间
iptables -A FORWARD -p tcp –syn -m limit –limit 1/s -j ACCEPT
iptables -A INPUT -i eth0 -m limit –limit 1/sec –limit-burst 5 -j ACCEPT
#每秒 最多3个 syn 封包 进入 表达为
iptables -N syn-flood
iptables -A INPUT -p tcp –syn -j syn-flood
iptables -A syn-flood -p tcp –syn -m limit –limit 1/s –limit-burst 3 -j RETURN
iptables -A syn-flood -j REJECT
#设置syncookies
sysctl -w .ipv4.tcp_syncookies=1
sysctl -w .ipv4.tcp_max_syn_backlog=3072
sysctl -w .ipv4.tcp_synack_retries=0
sysctl -w .ipv4.tcp_syn_retries=0
sysctl -w .ipv4.conf.all.send_redirects=0
sysctl -w .ipv4.conf.all.aept_redirects=0
sysctl -w .ipv4.conf.all.forwarding=0
sysctl -w .ipv4.icmp_echo_ignore_broadcasts=1
#防止PING
sysctl -w .ipv4.icmp_echo_ignore_all=1
#拦截具体IP范围
iptables -A INPUT -s 10.0.0.0/8 -i eth0 -j Drop