How do you automatically block all incoming traffic by creating custom rule for every connection (in real time) using iptables?

To clarify - the situation is that my linux box is being DDOSed via port 80 and I want to set iptables to catch and block all attacking bots. After couple of hours (and hopefully all the bots used up), I lift the policy and let the legitimate www traffic in.

EDIT: Or if you could suggest any other way of protecting myself against (probably) distributed SYN flood.

  • A good router will protect you against a syn flood attack.
    – Moab
    Mar 26 '11 at 22:45
  • Does this answer the question?
    – new123456
    Mar 29 '11 at 20:57

This is not bullet-proof but it should get you started. You can put this in a script and execute it on demand

iptables -N SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 5/second --limit-burst 50 -j RETURN
iptables -A SYN_FLOOD -j LOG --log-prefix "SYN flood: "
iptables -A SYN_FLOOD -j DROP

To shut this down just execute:

iptables -D SYN_FLOOD
  • Thanks, it will probably prove useful in the future - for now the original idea worked. I dropped and blocked all incoming connections for about 12 hours. Some ligitimate customers got caught but in the end there were about 2600 zombies blocked and the attack died out while I could open the site again. Crude solution but worked.
    – Halik
    Mar 30 '11 at 4:33
  • I am not sure I fully understand. You original question is also vague. If the answer was helpful you should vote-up, or accept or something. Your reputation is at risk MR :)
    – g24l
    Mar 31 '11 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.