Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do you automatically block all incoming traffic by creating custom rule for every connection (in real time) using iptables?

To clarify - the situation is that my linux box is being DDOSed via port 80 and I want to set iptables to catch and block all attacking bots. After couple of hours (and hopefully all the bots used up), I lift the policy and let the legitimate www traffic in.

EDIT: Or if you could suggest any other way of protecting myself against (probably) distributed SYN flood.

share|improve this question
    
A good router will protect you against a syn flood attack. –  Moab Mar 26 '11 at 22:45
    
Does this answer the question? –  new123456 Mar 29 '11 at 20:57
add comment

1 Answer

up vote 0 down vote accepted

This is not bullet-proof but it should get you started. You can put this in a script and execute it on demand

iptables -N SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 5/second --limit-burst 50 -j RETURN
iptables -A SYN_FLOOD -j LOG --log-prefix "SYN flood: "
iptables -A SYN_FLOOD -j DROP

To shut this down just execute:

iptables -D SYN_FLOOD
share|improve this answer
    
Thanks, it will probably prove useful in the future - for now the original idea worked. I dropped and blocked all incoming connections for about 12 hours. Some ligitimate customers got caught but in the end there were about 2600 zombies blocked and the attack died out while I could open the site again. Crude solution but worked. –  Halik Mar 30 '11 at 4:33
    
I am not sure I fully understand. You original question is also vague. If the answer was helpful you should vote-up, or accept or something. Your reputation is at risk MR :) –  g24l Mar 31 '11 at 0:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.