如何利用firewalld抵御DDOS攻击

开发中遇到流氓是常有的时,那么,我们该如何做好防御呢,比如利用centos自带的firewalld.

可以进行如下配置

#!/bin/bash
#firewall 接受 tcp syn 即rst 包的频率 限制 暂定 200/s 可根据实际测试结果和服务器配置进行调整
pak_num_limit=200
pak_limit_burst=600
#限制每个ip最大同时连接数
ip_max_conn_limit=2
#-Syn 洪水攻击(--limit 1/s 限制syn并发数每秒1次)
# ipv4
echo 'add  ipv4 syn limit .....'
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 4   -p tcp --dport 22 --tcp-flags SYN,ACK,FIN,RST SYN -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT  5   -p tcp --dport 22  --tcp-flags SYN,ACK,FIN,RST SYN -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 4   -p tcp --dport 80 --tcp-flags SYN,ACK,FIN,RST SYN -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT  5   -p tcp --dport 80  --tcp-flags SYN,ACK,FIN,RST SYN -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 4   -p tcp --dport 443 --tcp-flags SYN,ACK,FIN,RST SYN -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT  5   -p tcp --dport 443  --tcp-flags SYN,ACK,FIN,RST SYN -j $def_reject_policy
# ipv6
echo 'add  ipv6 syn limit .....'
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 4   -p tcp --dport 22 --tcp-flags SYN,ACK,FIN,RST SYN -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT  5   -p tcp --dport 22  --tcp-flags SYN,ACK,FIN,RST SYN -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 4   -p tcp --dport 80 --tcp-flags SYN,ACK,FIN,RST SYN -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT  5   -p tcp --dport 80  --tcp-flags SYN,ACK,FIN,RST SYN -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 4   -p tcp --dport 443 --tcp-flags SYN,ACK,FIN,RST SYN -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT  5   -p tcp --dport 443  --tcp-flags SYN,ACK,FIN,RST SYN -j $def_reject_policy

# 扫描 flood 
# ipv4 
echo 'add  ipv4 rst limit .....'
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 4   -p tcp  --dport 22   --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT  5   -p tcp --dport 22  --tcp-flags SYN,ACK,FIN,RST RST -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 4   -p tcp  --dport 80   --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT  5   -p tcp --dport 80  --tcp-flags SYN,ACK,FIN,RST RST -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 4   -p tcp  --dport 443   --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT  5   -p tcp --dport 443  --tcp-flags SYN,ACK,FIN,RST RST -j $def_reject_policy
#ipv6 
echo 'add  ipv6 rst limit .....'
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 4   -p tcp  --dport 22   --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT  5   -p tcp --dport 22  --tcp-flags SYN,ACK,FIN,RST RST -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 4   -p tcp  --dport 80   --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT  5   -p tcp --dport 80  --tcp-flags SYN,ACK,FIN,RST RST -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 4   -p tcp  --dport 443   --tcp-flags SYN,ACK,FIN,RST RST -m limit  --limit $pak_num_limit/s --limit-burst $pak_limit_burst -j ACCEPT
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT  5   -p tcp --dport 443  --tcp-flags SYN,ACK,FIN,RST RST -j $def_reject_policy

#限制每个客户端最大链接数
# ip6
echo 'add  ipv6 conn  limit .....'
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --syn --dport 80 -m connlimit --connlimit-above $ip_max_conn_limit -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --syn --dport 22 -m connlimit --connlimit-above $ip_max_conn_limit -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --syn --dport 443 -m connlimit --connlimit-above $ip_max_conn_limit -j $def_reject_policy
# ip4
echo 'add  ipv4 conn  limit .....'
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --syn --dport 80 -m connlimit   --connlimit-above $ip_max_conn_limit -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --syn --dport 22 -m connlimit  --connlimit-above $ip_max_conn_limit -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --syn --dport 443 -m connlimit --connlimit-above $ip_max_conn_limit -j $def_reject_policy

# 其他 攻击包 过滤 
# ipv4
echo 'add  ipv4  risk  pak drop policy .....'
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --tcp-flags ALL ALL -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --tcp-flags ALL FIN,PSH,URG -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --tcp-flags ALL NONE -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --tcp-flags SYN,RST SYN,RST -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv4 filter INPUT 3 -p tcp --tcp-flags SYN,FIN  SYN,FIN -j $def_reject_policy
# ipv6
echo 'add  ipv6  risk  pak drop policy .....'
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --tcp-flags ALL NONE -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --tcp-flags SYN,RST SYN,RST -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --tcp-flags SYN,FIN  SYN,FIN -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --tcp-flags ALL ALL -j $def_reject_policy
firewall-cmd --direct --permanent  --add-rule ipv6 filter INPUT 3 -p tcp --tcp-flags ALL FIN,PSH,URG -j $def_reject_policy