Помогите iptables докрутить

iptables -F

rmmod xt_recent
modprobe ipt_recent ip_list_tot=50000 ip_pkt_list_tot=3 

iptables -N fw-input
iptables -N http
iptables -N nntp
iptables -N icmp
iptables -N existing
iptables -N white


iptables -A INPUT -i vmbr0 -j fw-input
iptables -A FORWARD -i vmbr0  -j fw-input

# enable local connects
iptables -A fw-input -i lo -j ACCEPT

# bad packets
iptables -A fw-input -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset 
iptables -A fw-input -p tcp ! --syn -m state --state NEW -m limit --limit 3/minute -j LOG --log-level debug --log-prefix NEW-NOT-SYN:
iptables -A fw-input -p tcp ! --syn -m state --state NEW -j DROP

# whitelist
iptables -A fw-input -p tcp -j white
### opera
iptables -A white -s 80.239.224.0/19 -j ACCEPT
iptables -A white -s 82.145.208.0/21 -j ACCEPT
### google
iptables -A white -s 66.249.64.0/19 -j ACCEPT
### end
iptables -A white -j RETURN

# lock catched
iptables -A fw-input -m recent --rcheck --name BLOCK --seconds 250 --rttl -j REJECT --reject-with icmp-host-prohibited
iptables -A fw-input -m recent --update --name BLOCK --seconds 300 --rttl -j REJECT --reject-with icmp-host-prohibited

# pass established
iptables -A fw-input -m state --state RELATED,ESTABLISHED -j existing
iptables -A existing -p tcp -m connlimit --connlimit-above 90 -m recent --set --name BLOCK_PARALLELS -j REJECT --reject-with icmp-host-prohibited
iptables -A existing -j ACCEPT

# http
iptables -A fw-input -p tcp -m multiport --dports 80,443 -m state --state NEW -j http
iptables -A http -p tcp -m hashlimit --hashlimit-name http --hashlimit-mode srcip --hashlimit-above 20/sec --hashlimit-burst 90 \
 --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-expire 3000000 \
 -m recent --set --name BLOCK -j DROP
iptables -A http -j ACCEPT

# icmp
iptables -A fw-input -p icmp -j icmp
iptables -A icmp -p icmp --icmp-type 0 -j ACCEPT 
iptables -A icmp -p icmp --icmp-type 3 -j ACCEPT
iptables -A icmp -p icmp --icmp-type 8 -m limit --limit 10/second -j ACCEPT 
iptables -A icmp -p icmp --icmp-type 11 -j ACCEPT 
iptables -A icmp -j DROP


# nntp
iptables -A fw-input -p tcp -m multiport --dports 119,563,1119 -m state --state NEW -j nntp
iptables -A nntp -p tcp -m hashlimit --hashlimit-name nntp --hashlimit-mode srcip --hashlimit-above 10/sec \
 --hashlimit-htable-size 32768 --hashlimit-htable-max 32768 --hashlimit-htable-expire 3000000 \
 -m recent --set --name BLOCK_NNTP -j DROP
iptables -A nntp -j ACCEPT

# ssh
iptables -A fw-input -p tcp -m tcp --dport 2222 -j ACCEPT

# finish
iptables -A fw-input -p tcp -m limit --limit 3/minute -j LOG --log-level debug 
iptables -A fw-input -p tcp -j DROP
iptables -A fw-input -m limit --limit 3/minute -j LOG --log-level debug --log-prefix NONTCP-DROP:
iptables -A fw-input -j DROP

Feb  8 05:56:02 hz kernel: IN=vmbr0 OUT=venet0 PHYSIN=eth0 SRC=155.140.133.56 DST=188.40.118.48 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=24115 PROTO=TCP SPT=55864 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 
Feb  8 05:56:19 hz kernel: IN=vmbr0 OUT=venet0 PHYSIN=eth0 SRC=109.64.209.32 DST=188.40.118.48 LEN=40 TOS=0x00 PREC=0x00 TTL=114 ID=17864 DF PROTO=TCP SPT=54845 DPT=80 WINDOW=16894 RES=0x00 ACK FIN URGP=0 
Feb  8 05:56:31 hz kernel: IN=vmbr0 OUT=venet0 PHYSIN=eth0 SRC=95.172.129.231 DST=188.40.118.48 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=2658 DF PROTO=TCP SPT=19876 DPT=80 WINDOW=0 RES=0x00 RST URGP=0 
Feb  8 05:56:50 hz kernel: IN=vmbr0 OUT=venet0 PHYSIN=eth0 SRC=89.106.197.1 DST=188.40.118.48 LEN=40 TOS=0x00 PREC=0x00 TTL=120 ID=10539 DF PROTO=TCP SPT=1362 DPT=80 WINDOW=65288 RES=0x00 ACK FIN URGP=0 
Feb  8 05:57:12 hz kernel: IN=vmbr0 OUT=venet0 PHYSIN=eth0 SRC=89.106.197.1 DST=188.40.118.48 LEN=40 TOS=0x00 PREC=0x00 TTL=120 ID=12007 DF PROTO=TCP SPT=1362 DPT=80 WINDOW=65288 RES=0x00 ACK FIN URGP=0 
Feb  8 05:57:30 hz kernel: IN=vmbr0 OUT=venet0 PHYSIN=eth0 SRC=89.106.197.1 DST=188.40.118.48 LEN=40 TOS=0x00 PREC=0x00 TTL=120 ID=13485 DF PROTO=TCP SPT=1356 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0

sysctl -w kernel.msgmnb=65536
sysctl -w kernel.msgmax=65536
sysctl -w kernel.shmmax=494967295
sysctl -w kernel.shmall=268435456

sysctl -w net.core.rmem_max=33554432
sysctl -w net.core.wmem_max=33554432
sysctl -w net.core.rmem_default=8388608
sysctl -w net.core.wmem_default=4194394
sysctl -w net.core.netdev_max_backlog=10000
sysctl -w net.core.somaxconn=262144

sysctl -w "net.ipv4.ip_local_port_range=1025 65535"
sysctl -w net.ipv4.netfilter.ip_conntrack_max=1048576

sysctl -w "net.ipv4.tcp_rmem=4096 8388608 16777216"
sysctl -w "net.ipv4.tcp_wmem=4096 4194394 16777216"
sysctl -w "net.ipv4.tcp_mem=50576 64768 98152"
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_sack=0
sysctl -w net.ipv4.tcp_ecn=0
sysctl -w net.ipv4.tcp_window_scaling=0
sysctl -w net.ipv4.tcp_timestamps=0
sysctl -w net.ipv4.tcp_fin_timeout=7
sysctl -w net.ipv4.tcp_max_tw_buckets=720000
sysctl -w net.ipv4.tcp_tw_recycle=1
sysctl -w net.ipv4.tcp_tw_reuse=1
sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sysctl -w net.ipv4.tcp_max_orphans=2255360
sysctl -w net.ipv4.tcp_synack_retries=2
sysctl -w net.ipv4.tcp_syn_retries=2
sysctl -w net.ipv4.tcp_orphan_retries=1
sysctl -w net.ipv4.tcp_keepalive_intvl=10
sysctl -w net.ipv4.tcp_keepalive_probes=5
sysctl -w net.ipv4.tcp_keepalive_time=60