Скрипт:
#!/bin/bash
IPT='iptables'
# Prepare and set up iptables modules
rmmod xt_recent
modprobe ipt_recent ip_list_tot=5000 ip_pkt_list_tot=255
# FLUSH
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t raw -F
$IPT -t filter -F
$IPT -t nat -X
$IPT -t mangle -X
$IPT -t raw -X
$IPT -t filter -X
echo "FLUSH TABLES";
# Create custom chains
$IPT -N BAN
$IPT -N SUSPIC
### banned ###
#$IPT -A INPUT --source 77.40.0.0/24 -j REJECT
echo "ADDED BANS";
## 1)
## BAN: drop all for 30 minutes from this IP
## SUSPIC: 3 suspic messages in 60 secs = ban
##
$IPT -A INPUT -m recent --name ban --rcheck --seconds 1800 --hitcount 1 -j DROP
$IPT -A INPUT -m recent --name suspic --rcheck --seconds 60 --hitcount 3 -j BAN
$IPT -A SUSPIC -m recent --name suspic --set -j DROP
$IPT -A BAN -m recent --name ban --set -j DROP
## 2)
## Drop broken packets. NEW packet alway must be have --syn flag.
##
$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m multiport --dports 80,443,... -j DROP
## 3)
## Max established connections from 1 IP
##
$IPT -A INPUT -p tcp --dport 22 -m connlimit --connlimit-above 10 -j DROP
## 4)
## Protect SSH agains port scan. ACCEPT only after 2 connection trys in 15 sec
##
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name ssh --set
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name ssh ! --rcheck --seconds 3600 --hitcount 3 -j REJECT
## 5)
## Drop burst connections. Use hashlimit instead of limit due to possibility to limit connections from one IP.
##
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m hashlimit ! --hashlimit 2/s --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name SSH -j DROP
$IPT -A INPUT -p tcp --dport 80 -m state --state NEW -m hashlimit ! --hashlimit 4/s --hashlimit-burst 40 --hashlimit-mode srcip --hashlimit-name SITE -j SUSPIC
echo "ADDED RULES";
Выдает:
Error: Module xt_recent is not currently loaded
libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/2.6.32-042stab108.8/modules.dep.bin'
iptables v1.4.14: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.4.14: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
FLUSH TABLES
ADDED BANS
iptables v1.4.14: invalid port/service `...' specified
Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
ADDED RULES
