supamastec

supamastec / iptables-ddos-protection.txt

Created August 16, 2019 02:02 — forked from peerapach/iptables-ddos-protection.txt

Build Your Own DDoS Protection With Linux & IPtables

	DEV=eth0
	PORT=80


	### Use SYNPROXY ###
	/sbin/iptables -t raw -A PREROUTING -i $DEV -p tcp -m tcp --syn --dport $PORT -j CT --notrack
	/sbin/iptables -t mangle -A INPUT -i $DEV -p tcp -m conntrack --ctstate INVALID,UNTRACKED --dport $PORT -j SYNPROXY \
	--sack-perm --timestamp --wscale 7 --mss 1460
	/sbin/iptables -t mangle -A INPUT -i $DEV -p tcp -m conntrack --ctstate INVALID --dport $PORT -j DROP