The article is reproduced for easy sorting and induction. The source address is: https://cloud.tencent.com/developer/article/1722230
When a Linux server is attacked, sometimes there are several main IP addresses. If you can reject these IP attacks, it will greatly reduce the pressure on the server, and maybe the server will return to normal.
Under Linux, IP blocking can take two forms: blocking network segments and blocking a single IP. Generally speaking, today's attackers will not use the IP of a network segment to attack (too ostentatious). The IP is generally hashed. Therefore, the following describes in detail the command to block a single IP and the command to unseal a single IP.
Linux Firewall: iptables common commands for disabling and unsealing IP
Under Linux, ipteables is used to maintain the IP rule table. To block or unseal IP is actually to add rules to the inbound part in the IP rule table.
To block an IP, use the following command:
iptables -I INPUT -s ***.***.***.*** -j DROP
To unseal an IP, use the following command:
iptables -D INPUT -s ***.***.***.*** -j DROP
Parameter - I means Insert and - D means Delete. Followed by the rule, INPUT indicates inbound, *****************************************************************************.
In addition, you can use the following command to view the current IP rule table:
iptables -list
For example, to block the IP address 123.44.55.66, enter:
iptables -I INPUT -s 123.44.55.66 -j DROP
To unseal, replace - I with - D, provided that iptables already has this record. If you want to clear the blocked IP address, you can enter:
iptables -flush
To add an IP segment to the blocked list, use the following command:
iptables -I INPUT -s 121.0.0.0/8 -j DROP
In fact, the IP part of a single IP is replaced by the IP segment expression of Linux. There are many detailed explanations about IP segment expressions on the Internet, which are not mentioned here.
I believe that with the help of iptables, it's no problem to solve small DDoS attacks!
Attachment: other commonly used commands
Edit iptables file
vi /etc/sysconfig/iptables
Turn off / on / restart firewall
/etc/init.d/iptables stop #start on #Restart restart
Verify that the rules are in effect:
iptables -L
Save and restart iptables
/etc/rc.d/init.d/iptables save service iptables restart
Some common commands for sealing ip segments in practical iptables under linux:
The commands for sealing a single IP are:
iptables -I INPUT -s 211.1.0.0 -j DROP
The commands for sealing IP segments are:
iptables -I INPUT -s 211.1.0.0/16 -j DROP iptables -I INPUT -s 211.2.0.0/16 -j DROP iptables -I INPUT -s 211.3.0.0/16 -j DROP
The command to seal the entire segment is:
iptables -I INPUT -s 211.0.0.0/8 -j DROP
The command to seal several paragraphs is:
iptables -I INPUT -s 61.37.80.0/24 -j DROP iptables -I INPUT -s 61.37.81.0/24 -j DROP
There are three ways to start self-operation on the server:
1. Add it to / etc/rc.local
2,iptables-save >;/ etc/sysconfig/iptables can put your current iptables rules into / etc/sysconfig/iptables, which will be executed automatically when the system starts iptables.
3. service iptables save can also put your current iptables rules in / etc/sysconfig/iptables, which will be executed automatically when the system starts iptables.
The latter two are better. Generally, iptables service will be started before network service, which is more secure.
If unsealing: iptables -D INPUT -s IP address - j REJECT iptables -F are all cleared
How does the Linux Firewall Iptable allow only a certain ip to access port 80 and only a specific ip to access a port? Referring to the following command, only 46.166.150.22 is allowed to access port 80 of this machine. If you want to set another ip or port, you can change it.
iptables -I INPUT -p TCP –dport 80 -j DROP iptables -I INPUT -s 46.166.150.22 -p TCP –dport 80 -j ACCEPT
After executing the above two commands under the root user, restart iptables and service iptables restart
Check whether iptables are effective:
[root@www.xxx.com]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp – 46.166.150.22 anywhere tcp dpt:http DROP tcp – anywhere anywhere tcp dpt:http Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
The above command is to disable port 80 for the entire server (all ip addresses). What if you only need to disable port 80 for an ip address on the server?
The following command allows only ip from 174.140.3.190 to access port 80 of 216.99.1.216 on the server
iptables -A FORWARD -s 174.140.3.190 -d 216.99.1.216 -p tcp -m tcp –dport 80 -j ACCEPT iptables -A FORWARD -d 216.99.1.216 -p tcp -m tcp –dport 80 -j DROP
More iptables reference commands are as follows:
1. Back up iptables first
# cp /etc/sysconfig/iptables /var/tmp
You need to open 80 ports and specify IP and LAN
The following three lines mean:
Close all ports 80 first
Open port 80 at 192.168.1.0/24 end of ip section
Open port 80 of ip section 211.123.16.123/24
# iptables -I INPUT -p tcp –dport 80 -j DROP # iptables -I INPUT -s 192.168.1.0/24 -p tcp –dport 80 -j ACCEPT # iptables -I INPUT -s 211.123.16.123/24 -p tcp –dport 80 -j ACCEPT
These are temporary settings.
2. Then save iptables
# service iptables save
3. Restart the firewall
#service iptables restart
The following are the ports. First seal them all, and then open some IP addresses
iptables -I INPUT -p tcp –dport 9889 -j DROP iptables -I INPUT -s 192.168.1.0/24 -p tcp –dport 9889 -j ACCEPT
If NAT forwarding is used, remember to cooperate with the following to take effect
iptables -I FORWARD -p tcp –dport 80 -j DROP iptables -I FORWARD -s 192.168.1.0/24 -p tcp –dport 80 -j ACCEPT
Common IPTABLES rules are as follows:
Can only send and receive mail, everything else is closed
iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -j DROP iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -p udp –dport 53 -j ACCEPT iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -p tcp –dport 25 -j ACCEPT iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -p tcp –dport 110 -j ACCEPT
IPSEC NAT policy
iptables -I PFWanPriv -d 192.168.100.2 -j ACCEPT iptables -t nat -A PREROUTING -p tcp –dport 80 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:80 iptables -t nat -A PREROUTING -p tcp –dport 1723 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:1723 iptables -t nat -A PREROUTING -p udp –dport 1723 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:1723 iptables -t nat -A PREROUTING -p udp –dport 500 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:500 iptables -t nat -A PREROUTING -p udp –dport 4500 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:4500
NAT of FTP server
iptables -I PFWanPriv -p tcp –dport 21 -d 192.168.1.22 -j ACCEPT iptables -t nat -A PREROUTING -p tcp –dport 21 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.1.22:21
Only access to the specified web address is allowed
iptables -A Filter -p udp –dport 53 -j ACCEPT iptables -A Filter -p tcp –dport 53 -j ACCEPT iptables -A Filter -d www.ctohome.com -j ACCEPT iptables -A Filter -d www.guowaivps.com -j ACCEPT iptables -A Filter -j DROP
Open some ports of an IP, and close others
iptables -A Filter -p tcp –dport 80 -s 192.168.1.22 -d www.pconline.com.cn -j ACCEPT iptables -A Filter -p tcp –dport 25 -s 192.168.1.22 -j ACCEPT iptables -A Filter -p tcp –dport 109 -s 192.168.1.22 -j ACCEPT iptables -A Filter -p tcp –dport 110 -s 192.168.1.22 -j ACCEPT iptables -A Filter -p tcp –dport 53 -j ACCEPT iptables -A Filter -p udp –dport 53 -j ACCEPT iptables -A Filter -j DROP
Multiple ports
The copy code is as follows:
iptables -A Filter -p tcp -m multiport –destination-port 22,53,80,110 -s 192.168.20.3 -j REJECT
Continuous port
The copy code is as follows:
iptables -A Filter -p tcp -m multiport –source-port 22,53,80,110 -s 192.168.20.3 -j REJECT iptables -A Filter -p tcp –source-port 2:80 -s 192.168.20.3 -j REJECT
Internet access at designated time
iptables -A Filter -s 10.10.10.253 -m time –timestart 6:00 –timestop 11:00 –days Mon,Tue,Wed,Thu,Fri,Sat,Sun -j DROP iptables -A Filter -m time –timestart 12:00 –timestop 13:00 –days Mon,Tue,Wed,Thu,Fri,Sat,Sun -j ACCEPT iptables -A Filter -m time –timestart 17:30 –timestop 8:30 –days Mon,Tue,Wed,Thu,Fri,Sat,Sun -j ACCEPT
Disable multiple port services
iptables -A Filter -m multiport -p tcp –dport 21,23,80 -j ACCEPT
Connect WAN port NAT to PC
The copy code is as follows:
iptables -t nat -A PREROUTING -i $INTERNET_IF -d $INTERNET_ADDR -j DNAT –to-destination 192.168.0.1
Connect WAN port 8000 to NAT 192. 168. 100. Port 80 of 200
The copy code is as follows:
iptables -t nat -A PREROUTING -p tcp –dport 8000 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.1.22:80
The port to which the MAIL server is transferred
iptables -t nat -A PREROUTING -p tcp –dport 110 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.1.22:110 iptables -t nat -A PREROUTING -p tcp –dport 25 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.1.22:25
Only PING 202 is allowed. 96. 134. 133. Other services are prohibited
iptables -A Filter -p icmp -s 192.168.1.22 -d 202.96.134.133 -j ACCEPT iptables -A Filter -j DROP
Disable BT configuration
iptables –A Filter –p tcp –dport 6000:20000 –j DROP
Disable QQ firewall configuration
iptables -A Filter -p udp –dport ! 53 -j DROP iptables -A Filter -d 218.17.209.0/24 -j DROP iptables -A Filter -d 218.18.95.0/24 -j DROP iptables -A Filter -d 219.133.40.177 -j DROP
Based on MAC, you can only send and receive mail, and others are rejected
iptables -I Filter -m mac –mac-source 00:0A:EB:97:79:A1 -j DROP iptables -I Filter -m mac –mac-source 00:0A:EB:97:79:A1 -p tcp –dport 25 -j ACCEPT iptables -I Filter -m mac –mac-source 00:0A:EB:97:79:A1 -p tcp –dport 110 -j ACCEPT
Disable MSN configuration
iptables -A Filter -p udp –dport 9 -j DROP iptables -A Filter -p tcp –dport 1863 -j DROP iptables -A Filter -p tcp –dport 80 -d 207.68.178.238 -j DROP iptables -A Filter -p tcp –dport 80 -d 207.46.110.0/24 -j DROP
Only PING 202 is allowed. 96. 134. 133 other public IP addresses are not allowed to PING
iptables -A Filter -p icmp -s 192.168.1.22 -d 202.96.134.133 -j ACCEPT iptables -A Filter -p icmp -j DROP
Prohibit a MAC address from accessing the internet:
iptables -I Filter -m mac –mac-source 00:20:18:8F:72:F8 -j DROP
Prohibit PING of an IP address:
iptables –A Filter –p icmp –s 192.168.0.1 –j DROP
Disable an IP address service:
iptables –A Filter -p tcp -s 192.168.0.1 –dport 80 -j DROP iptables –A Filter -p udp -s 192.168.0.1 –dport 53 -j DROP
Only some services are allowed and others are rejected (2 rules)
iptables -A Filter -p tcp -s 192.168.0.1 –dport 1000 -j ACCEPT iptables -A Filter -j DROP
Disable a port service for an IP address
iptables -A Filter -p tcp -s 10.10.10.253 –dport 80 -j ACCEPT iptables -A Filter -p tcp -s 10.10.10.253 –dport 80 -j DROP
Disable a port service of a MAC address
iptables -I Filter -p tcp -m mac –mac-source 00:20:18:8F:72:F8 –dport 80 -j DROP
Prohibit a MAC address from accessing the internet:
iptables -I Filter -m mac –mac-source 00:11:22:33:44:55 -j DROP
Prohibit PING of an IP address:
iptables –A Filter –p icmp –s 192.168.0.1 –j DROP
The above is the whole content of this article. I hope it will be helpful to your study.