{"id":1742,"date":"2011-10-04T11:29:22","date_gmt":"2011-10-04T08:29:22","guid":{"rendered":"http:\/\/skeletor.org.ua\/?p=1742"},"modified":"2025-11-21T11:53:51","modified_gmt":"2025-11-21T09:53:51","slug":"%d0%b7%d0%b0%d1%89%d0%b8%d1%82%d0%b0-%d0%be%d1%82-%d1%84%d0%bb%d1%83%d0%b4%d0%b0-ddosa","status":"publish","type":"post","link":"https:\/\/skeletor.org.ua\/?p=1742","title":{"rendered":"\u0417\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0444\u043b\u0443\u0434\u0430, DDoS’a, \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438"},"content":{"rendered":"

\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d \u0442\u044e\u043d\u0438\u043d\u0433 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 sysctl<\/strong>. \u0422\u0430\u043a \u0436\u0435 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0440\u0430\u0437\u043d\u043e\u0433\u043e \u0440\u043e\u0434\u0430 \u0441\u043a\u0430\u043d\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, DDoS’a<\/strong>.<\/p>\n

\u0412\u0441\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0441\u0442\u0440\u0430\u0445 \u0438 \u0440\u0438\u0441\u043a.<\/p>\n

<\/p>\n

1) \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043c \u0442\u0430\u043a\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 sysctl:<\/span><\/strong><\/p>\n

fs.file-max = 6576702
\nnet.core.rmem_default=201250
\nnet.core.wmem_default=201250
\nnet.core.rmem_max = 16777216
\nnet.core.wmem_max = 16777216
\nnet.core.netdev_max_backlog = 10000
\nnet.core.somaxconn=32768
\nnet.ipv4.tcp_mem= 786432 1048576 996777216
\nnet.ipv4.tcp_rmem = 4096 87380 16777216
\nnet.ipv4.tcp_wmem = 4096 65536 16777216
\nnet.ipv4.tcp_fin_timeout=15
\nnet.ipv4.tcp_keepalive_time=1800
\nnet.ipv4.tcp_keepalive_intvl=5
\nnet.ipv4.tcp_keepalive_probes=3
\nnet.ipv4.tcp_synack_retries=3
\nnet.ipv4.tcp_syncookies=1
\nnet.ipv4.tcp_mtu_probing=1
\nnet.ipv4.tcp_window_scaling = 1
\nnet.ipv4.tcp_sack=0
\nnet.ipv4.tcp_max_syn_backlog=4096
\nnet.ipv4.tcp_max_tw_buckets = 720000
\nnet.ipv4.tcp_max_orphans = 65536
\nnet.ipv4.tcp_challenge_ack_limit = 999999999 (\u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 CVE-2016-5696)
\n<\/code><\/p>\n

\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u043e\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0432 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0438 TIME_WAIT<\/strong>, \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435: \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0432\u0440\u0435\u0434\u0438\u0442\u044c, \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c! \u041c\u043e\u0433\u0443\u0442 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0434\u043b\u044f \u044e\u0437\u0435\u0440\u043e\u0432 \u0438\u0437-\u0437\u0430 NAT’a<\/strong><\/p>\n

net.ipv4.tcp_tw_reuse = 1
\nnet.ipv4.tcp_tw_recycle = 1<\/code><\/p>\n

\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435:<\/strong><\/em><\/span> \u044f \u0432\u0435\u0440\u0441\u0438\u0438 \u044f\u0434\u0440\u0430 4.12<\/a> \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 tcp_tw_reuse<\/code>\u00a0\u0443\u0434\u0430\u043b\u0438\u043b\u0438.<\/p>\n

!!!<\/p>\n

net.ipv4.conf.all.send_redirects=0
\nnet.ipv4.conf.all.accept_redirects=0
\nnet.ipv4.conf.default.accept_redirects=0
\nnet.ipv4.conf.all.send_redirects = 0
\nnet.ipv4.conf.default.send_redirects = 0
\nnet.ipv4.conf.all.secure_redirects=0
\nnet.ipv4.conf.all.accept_source_route = 0
\nnet.ipv4.conf.default.accept_source_route = 0
\nnet.ipv4.conf.all.rp_filter=1
\nnet.ipv4.conf.default.rp_filter=1
\nnet.ipv4.ip_local_port_range=1024 65000
\nnet.ipv4.icmp_echo_ignore_broadcasts = 1
\nnet.ipv4.icmp_ignore_bogus_error_responses = 1
\nnet.ipv4.netfilter.ip_conntrack_max = 16777216
\nnet.netfilter.nf_conntrack_max = 16777216
\nkernel.msgmnb = 65536
\nkernel.msgmax = 65536
\nkernel.shmmax = 68719476736
\nkernel.shmall = 4294967296
\n<\/code><\/p>\n

\u041f\u0440\u0438 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0438 conntrack<\/strong> \u043d\u0443\u0436\u043d\u043e \u0438 \u0443\u0432\u0435\u0447\u0438\u0447\u0438\u0442\u044c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e buckets<\/strong> \u0434\u043b\u044f \u0445\u044d\u0448-\u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439 \u0432\u0441\u0435 \u0442\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u0438 (\u044d\u0442\u043e \u043e\u043f\u0446\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u044f nf_conntrack<\/strong>):<\/p>\n

\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0439\u043b \/etc\/modprobe.d\/nf_conntrack<\/strong> \u0442\u0430\u043a\u043e\u0433\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f (\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0445\u043e\u0442\u044f \u0431\u044b \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0430 \u043e\u0442 nf_conntrack_max<\/strong>)<\/p>\n

options nf_conntrack hashsize=8388608<\/code><\/p>\n

\u0418\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u0430\u043b\u0435\u0442\u0443 \u0442\u0430\u043a:<\/p>\n

echo \"8388608\" > \/sys\/module\/nf_conntrack\/parameters\/hashsize<\/code><\/p>\n

\u041d\u043e \u0432\u0430\u0436\u043d\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c \u0438 \u043f\u0440\u043e \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u0445<\/p>\n

The size of kernel memory used by netfilter connection tracking is:<\/span><\/p>\n

size_of_mem_used_by_conntrack (in bytes) = CONNTRACK_MAX * sizeof(struct ip_conntrack) + HASHSIZE * sizeof(struct list_head)<\/span><\/p>\n

where:<\/span><\/p>\n

sizeof(struct ip_conntrack) can vary quite much, depending on architecture, kernel version and compile-time configuration. To know its size, see the kernel log message at ip_conntrack initialization time.<\/span><\/p>\n

sizeof(struct ip_conntrack) is around 300 bytes on i386 for 2.6.5, but heavy development around 2.6.10 make it vary between 352 and 192 bytes!<\/span><\/p>\n

sizeof(struct list_head) = 2 * size_of_a_pointer On i386, size_of_a_pointer is 4 bytes.<\/span><\/p><\/blockquote>\n

\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e \u043d\u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0435\u0441\u0442\u044c \u0437\u0434\u0435\u0441\u044c<\/a><\/p>\n

\u041d\u0430 \u0441\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0438\u043c\u0435\u0435\u0442 \u0441\u043c\u044b\u0441\u043b \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u0447\u0438\u0441\u043b\u043e \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u044b\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a, \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0430\u0435\u0442\u0441\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 TCP<\/strong>, \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0435 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u042d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 net.ipv4.tcp_orphan_retries<\/strong>. \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043e\u0431\u044b\u0447\u043d\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 7<\/strong>, \u043d\u043e \u0435\u0441\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0441\u0438\u043b\u044c\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u0430, \u0438\u043c\u0435\u0435\u0442 \u0441\u043c\u044b\u0441\u043b \u0443\u043c\u0435\u043d\u044c\u0448\u0438\u0442\u044c \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0442\u0430\u043a \u043a\u0430\u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u0433\u043b\u043e\u0449\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432.<\/p>\n

net.ipv4.tcp_orphan_retries=2<\/code><\/p>\n

\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u0431\u043e\u043b\u044c\u0448\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 initrwnd\/initrwnd<\/strong> (\u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u0440\u0430\u0437\u043c\u0435\u0440 CWND<\/strong> \u043e\u043a\u043d\u0430):<\/p>\n

# ip route change default via DEFAULT_GW dev OUT_INTERFACE initrwnd 20 initcwnd 20<\/code><\/p>\n

2) ipset<\/span><\/strong><\/p>\n

IP Sets<\/strong>\u00a0\u2013 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u044f\u0434\u0440\u0430\u00a0iptables<\/strong>, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043a\u043e\u043c\u0444\u043e\u0440\u0442\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u0431\u043e\u043b\u044c\u0448\u0438\u043c\u0438 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0430\u0434\u0440\u0435\u0441\u043e\u0432\/\u0441\u0435\u0442\u0435\u0439. \u041f\u0440\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u0438 \u043f\u0440\u0430\u0432\u0438\u043b iptables<\/strong> \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043c\u044b \u043e\u043f\u0435\u0440\u0438\u0440\u0443\u0435\u043c \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0441\u043f\u0438\u0441\u043a\u0430\u043c\u0438.<\/p>\n

\u0414\u0435\u043b\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0445\u043e\u0441\u0442\u043e\u0432 \u0431\u043e\u043b\u044c\u0448\u0435 1000<\/strong> \u0447\u0435\u0440\u0435\u0437 iptables<\/strong> – load avarage<\/strong> \u0431\u0443\u0434\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043c, \u0442\u0430\u043a \u043a\u0430\u043a \u0441\u0430\u043c iptables<\/strong> \u043f\u043b\u043e\u0445\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e\u043c \u0445\u043e\u0441\u0442\u043e\u0432. \u041d\u0430\u043c\u043d\u043e\u0433\u043e \u043b\u0443\u0447\u0448\u0435 \u0441 \u043d\u0438\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441\u0430\u043c ipset<\/strong>. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u0438\u043c\u0435\u043d\u043d\u043e \u0435\u0433\u043e.<\/p>\n

3) \u0417\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0442\u0430\u043a.<\/span><\/strong><\/p>\n

– SYN<\/span><\/em><\/strong><\/p>\n

iptables -A INPUT -p tcp ! \u2013syn -m state --state NEW -j DROP
\niptables\u00a0-A OUTPUT -p tcp ! \u2013syn -m state --state NEW -j DROP<\/code><\/p>\n

– SYN Flood<\/span><\/strong><\/em><\/p>\n

\u0421\u0442\u0430\u0432\u0438\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0432 24<\/strong> \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u0443 (\u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e 48<\/strong> \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439)<\/p>\n

iptables -t mangle -N syn-flood
\niptables -t mangle -A syn-flood -m limit --limit 24\/s --limit-burst 48 -j RETURN
\niptables -t mangle -A syn-flood -m limit --limit 10\/s --limit-burst 10 -j LOG --log-prefix \"IPT: DOS (dropped): \"
\niptables -t mangle -A syn-flood -j DROP
\niptables -t mangle -A PREROUTING -p tcp --syn -j syn-flood<\/code><\/p>\n

\u041b\u0438\u0431\u043e \u0442\u0430\u043a:<\/p>\n

\u0421\u0442\u0430\u0432\u0438\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0432 100<\/strong> \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u0443 (\u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e 150<\/strong> \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439)<\/p>\n

iptables -N syn-flood
\niptables -A syn-flood -m limit --limit 100\/second --limit-burst 150 -j RETURN
\niptables -A syn-flood -j LOG --log-prefix \"SYN flood: \"
\niptables -A syn-flood -j DROP<\/code><\/p>\n

–\u00a0FIN\/X\/N<\/span><\/strong><\/em><\/p>\n

iptables -A INPUT \u2013p tcp \u2013m tcp \u2013-tcp-flags FIN,ACK FIN -j DROP
\niptables -A INPUT \u2013p tcp \u2013m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG \u2013j DROP
\niptables\u00a0-A INPUT \u2013p tcp \u2013m tcp \u2013-tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE \u2013j DROP
\niptables -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
\niptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
\niptables -A FORWARD -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
\niptables -A FORWARD -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
\niptables -A FORWARD -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
\niptables -A FORWARD -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP<\/code><\/p>\n

– NMAP \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435<\/span><\/strong><\/em><\/p>\n

## nmap -sS (Scan: SYN+ACK = no defense... )
\n## nmap -sX (Scan: SYN+ACK+FIN+RST [+PSH+URG] = not implemented in TCP)
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST ALL -j LOG --log-prefix \"IPT: Scan: XMAS0: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST ALL -j REJECT --reject-with tcp-reset
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags ALL FIN,URG,PSH -j LOG --log-prefix \"IPT: Scan: XMAS1: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags ALL FIN,URG,PSH -j REJECT --reject-with tcp-reset
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG --log-prefix \"IPT: Scan: XMAS2: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags ALL SYN,RST,ACK,FIN,URG -j REJECT --reject-with tcp-reset
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags ALL ALL -j LOG --log-prefix \"IPT: Scan: XMAS2: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags ALL ALL -j REJECT --reject-with tcp-reset
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix \"IPT: Scan: SYN-RST: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,RST SYN,RST -j REJECT --reject-with tcp-reset<\/code><\/p>\n

#FINGERPRINTING
\niptables -A INPUT -p tcp --dport 0 -j DROP
\niptables -A INPUT -p udp --dport 0 -j DROP
\niptables -A INPUT -p tcp --sport 0 -j DROP
\niptables -A INPUT -p udp --sport 0 -j DROP<\/code><\/p>\n

## nmap -sN (Scan: none of any flags = not implemented in TCP)
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST NONE -m limit --limit 10\/minute --limit-burst 10 -j LOG --log-prefix \"IPT: Scan: empty flags: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST NONE -j REJECT --reject-with tcp-reset<\/code><\/p>\n

## nmap -sF (Scan: only FIN)
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST FIN -m limit --limit 10\/minute --limit-burst 10 -j LOG --log-prefix \"IPT: Scan: only FIN: \"
\niptables -A INPUT -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST FIN -j REJECT --reject-with tcp-reset<\/code><\/p>\n

###[ hach_scan shain ]---------------------------------------------------------------
\niptables -t filter -N hack_scan
\n## nmap -sS (Scan: SYN+ACK = no defense... )
\n## nmap -sX (Scan: SYN+ACK+FIN+RST [+PSH+URG] = not implemented in TCP)
\niptables -t filter -A hack_scan -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST ALL -j LOG --log-prefix \"IPT: Scan: SYN+ACK+FIN+RST: \"
\niptables -t filter -A hack_scan -p tcp -m state --state ! ESTABLISHED --tcp-flags SYN,ACK,FIN,RST ALL -j REJECT --reject-with tcp-reset
\n<\/code>
\n## NEW, not SYN
\niptables -t filter -A hack_scan -p tcp ! --syn -m state --state NEW -m limit --limit 10\/minute --limit-burst 10 -j LOG --log-prefix \"IPT: NEW not SYN (rejected): \"
\niptables -t filter -A hack_scan -p tcp ! --syn -m state --state NEW -j REJECT --reject-with tcp-reset
\n###[ end of hach_scan chain ]==========================================================<\/code><\/p>\n

iptables -t filter -A INPUT -p ALL -j hack_scan<\/code><\/p>\n

4) \u041f\u0440\u043e\u0447\u0438\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f.<\/span><\/strong><\/p>\n

\u041c\u0430\u043a\u0441\u0438\u043c\u0443\u043c 10<\/strong> \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043a 80<\/strong> \u043f\u043e\u0440\u0442\u0443 \u0441 \u043e\u0434\u043d\u043e\u0433\u043e IP<\/strong><\/p>\n

iptables -A INPUT -p tcp --dport 80 -m iplimit --iplimit-above 10 -j REJECT<\/code><\/p>\n

\u043b\u0438\u0431\u043e \u0442\u0430\u043a<\/p>\n

iptables -I INPUT -p tcp -m tcp --dport 80 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j DROP<\/code><\/p>\n

5) \u0421\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u044f.<\/span><\/strong><\/p>\n

\u0422\u0430\u043a\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0431\u044b\u0441\u0442\u0440\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c log<\/strong>-\u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u0442\u0440\u043e\u043a \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0443\u0436\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c fail2ban<\/strong> \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 ipset<\/strong>. \u041f\u0440\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u0443\u0436\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 – \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0439\u0442\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0437\u0430\u043d\u043e\u0441\u0430 \u043d\u0443\u0436\u043d\u043e\u0433\u043e IP<\/strong> \u0432 \u043d\u0430\u0431\u043e\u0440 \u043e\u0442 ipset<\/strong>.<\/p>\n

6) \u0420\u0430\u0431\u043e\u0442\u0430 \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e, swap.<\/span><\/strong><\/p>\n

vm.swappiness=10
\nvm.vfs_cache_pressure=1000<\/code><\/span><\/strong><\/p>\n

\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e \u043d\u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0435\u0441\u0442\u044c \u0437\u0434\u0435\u0441\u044c<\/a><\/p>\n

7) \u0410\u043d\u0430\u043b\u0438\u0437 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438.<\/span><\/strong><\/p>\n

\u0412\u043c\u0435\u0441\u0442\u043e netstat<\/strong> \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 ss<\/strong>. \u0412\u043e\u0442, \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u043e\u0432 \u0438\u0437 \u0441\u0435\u0442\u0438:<\/p>\n

# time (netstat -an|grep \":80\\ \"|wc -l)\n42537\nreal\t      0m7.001s\nuser\t      0m0.388s\nsys\t       0m6.720s\n\n# time (ss -an|grep \":80\\ \"|wc -l)\n41403\nreal\t      0m0.139s\nuser\t      0m0.168s\nsys\t       0m0.068s\n<\/pre>\n
\u041a\u0430\u043a \u0432\u0438\u0434\u0438\u043c, \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u043d\u0430\u043b\u0438\u0446\u043e.<\/p>\n
8 ) \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b<\/span><\/strong>.<\/p>\n
logtop<\/a><\/p>\n
9)\u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e<\/span><\/strong>.<\/p>\n
https:\/\/habr.com\/ru\/company\/otus\/blog\/550820\/
\nhttps:\/\/blog.cloudflare.com\/syn-packet-handling-in-the-wild\/
\nhttps:\/\/javapipe.com\/blog\/iptables-ddos-protection\/<\/p>\n
10) \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 BPF<\/strong><\/span><\/p>\n
https:\/\/habr.com\/ru\/articles\/966938\/<\/p>\n","protected":false},"excerpt":{"rendered":"
\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d \u0442\u044e\u043d\u0438\u043d\u0433 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 sysctl. \u0422\u0430\u043a \u0436\u0435 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0440\u0430\u0437\u043d\u043e\u0433\u043e \u0440\u043e\u0434\u0430 \u0441\u043a\u0430\u043d\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, DDoS’a. \u0412\u0441\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0441\u0432\u043e\u0439 \u0441\u0442\u0440\u0430\u0445 \u0438 \u0440\u0438\u0441\u043a.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,13],"tags":[],"class_list":["post-1742","post","type-post","status-publish","format-standard","hentry","category-linux","category-security"],"_links":{"self":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/1742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1742"}],"version-history":[{"count":55,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/1742\/revisions"}],"predecessor-version":[{"id":6648,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/1742\/revisions\/6648"}],"wp:attachment":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}