1

I have the following rules applied as a part of DDoS prevention.

To prevent Spoofed packets

-A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
-A INPUT -s 255.0.0.0/8 -j DROP
-A INPUT -s 0.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
-A INPUT -s 0.0.0.0/8 -j DROP

To prevent Stealth scan and TCP SYN flood

-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "Stealth scan attempt?"
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 

Now we want to enforce no of connections that are allowed per IP Address per minute . For that I was planning to use --limit extensions. But looks now it is recommended to use --cstate extension. Few queries..

  1. What is the default no of connections that are allowed per ip address per minute/second with iptables.
  2. Default no of connections per minute/second? Any such limitation at OS level
  3. Suppose I want to allow 60 connections per second and if it goes beyond that limit, I will enforce to 25 connections per second. For this below rule is fine

    /sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 25/s --limit-burst 60 -j ACCEPT
    /sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
    

Is the second rule necessary after adding the first rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.