insmod ebtables insmod ebt_mark insmod ebtable_filter #Reduce DoS'ing ability by reducing timeouts echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time echo 1 > /proc/sys/net/ipv4/tcp_window_scaling echo 0 > /proc/sys/net/ipv4/tcp_sack echo 1280 > /proc/sys/net/ipv4/tcp_max_syn_backlog #SYN COOKIES echo 1 > /proc/sys/net/ipv4/tcp_syncookies echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses echo "1" > /proc/sys/net/ipv4/conf/all/accept_redirects echo "1" > /proc/sys/net/ipv4/conf/all/log_martians ifconfig eth0 promisc up ifconfig eth1 promisc up ##### #QOS# ##### tc qdisc del dev eth0 root tc qdisc del dev eth1 root #Classify All as 13 tc qdisc add dev eth1 root handle 1: htb default 12 tc qdisc add dev eth0 root handle 1: htb default 12 #Limit to no more then 1024 KBITS totla tc class add dev eth0 parent 1: classid 1:1 htb rate 1024KBit ceil 1024Kbit tc class add dev eth1 parent 1: classid 1:1 htb rate 1024KBit ceil 1024Kbit #Always have 50% allowed for HTTP tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512KBit ceil 1024Kbit tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 80 0xffff flowid 1:10 tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 422 0xffff flowid 1:10 tc class add dev eth1 parent 1:1 classid 1:10 htb rate 512KBit ceil 1024Kbit tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dport 80 0xffff flowid 1:10 tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dport 422 0xffff flowid 1:10 #Always have 40% kbps allowed for SSH tc class add dev eth0 parent 1:1 classid 1:11 htb rate 409KBit ceil 1024Kbit tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 8022 0xffff flowid 1:11 tc class add dev eth1 parent 1:1 classid 1:11 htb rate 409KBit ceil 1024Kbit tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32 match ip dport 8022 0xffff flowid 1:11 #Always have 10% kbps allowed for eveything else tc class add dev eth0 parent 1:1 classid 1:12 htb rate 102Kbit ceil 1024Kbit tc class add dev eth1 parent 1:1 classid 1:12 htb rate 102Kbit ceil 1024Kbit ########## #FIREWALL# ########## ebtables -F iptables -F iptables -N BOTNET iptables -A BOTNET -j DROP -s 193.201.52.117 iptables -A BOTNET -j DROP -s 195.3.206.1 iptables -A BOTNET -j DROP -s 195.5.117.252 iptables -A BOTNET -j DROP -s 195.56.55.139 iptables -A BOTNET -j DROP -s 208.67.217.132 iptables -A BOTNET -j DROP -s 209.132.238.188 iptables -A BOTNET -j DROP -s 209.25.170.18 iptables -A BOTNET -j DROP -s 212.227.119.155 iptables -A BOTNET -j DROP -s 212.239.40.235 iptables -A BOTNET -j DROP -s 212.3.111.66 iptables -A BOTNET -j DROP -s 212.83.114.39 iptables -A BOTNET -j DROP -s 213.203.223.98 iptables -A BOTNET -j DROP -s 213.247.198.9 iptables -A BOTNET -j DROP -s 216.104.34.94 iptables -A BOTNET -j DROP -s 216.219.253.43 iptables -A BOTNET -j DROP -s 216.36.247.104 iptables -A BOTNET -j DROP -s 217.16.27.42 iptables -A BOTNET -j DROP -s 217.67.30.8 iptables -A BOTNET -j DROP -s 217.67.30.9 iptables -A BOTNET -j DROP -s 62.67.235.133 iptables -A BOTNET -j DROP -s 64.111.212.66 iptables -A BOTNET -j DROP -s 64.202.165.132 iptables -A BOTNET -j DROP -s 64.202.165.201 iptables -A BOTNET -j DROP -s 64.22.83.106 iptables -A BOTNET -j DROP -s 66.197.201.69 iptables -A BOTNET -j DROP -s 66.49.234.209 iptables -A BOTNET -j DROP -s 67.19.156.130 iptables -A BOTNET -j DROP -s 67.19.170.34 iptables -A BOTNET -j DROP -s 67.19.210.130 iptables -A BOTNET -j DROP -s 69.10.136.143 iptables -A BOTNET -j DROP -s 69.20.67.185 iptables -A BOTNET -j DROP -s 69.50.220.108 iptables -A BOTNET -j DROP -s 69.89.21.72 iptables -A BOTNET -j DROP -s 69.89.22.106 iptables -A BOTNET -j DROP -s 69.93.248.2 iptables -A BOTNET -j DROP -s 70.85.226.130 iptables -A BOTNET -j DROP -s 70.86.182.226 iptables -A BOTNET -j DROP -s 70.87.62.162 iptables -A BOTNET -j DROP -s 70.87.95.34 #iptables -A BOTNET -j DROP -s 72.29.69.171 #iptables -A BOTNET -j DROP -s 72.29.75.11 iptables -A BOTNET -j DROP -s 72.32.196.20/16 iptables -A BOTNET -j DROP -s 72.29.89.20/24 iptables -A BOTNET -j DROP -s 193.86.238.12 iptables -A BOTNET -j DROP -s 209.62.92.226 iptables -A BOTNET -j DROP -s 74.52.133.34 iptables -A BOTNET -j DROP -s 77.55.94.2 iptables -A BOTNET -j DROP -s 78.108.81.71 iptables -A BOTNET -j DROP -s 78.110.50.103 iptables -A BOTNET -j DROP -s 80.93.57.160 iptables -A BOTNET -j DROP -s 80.93.57.207 iptables -A BOTNET -j DROP -s 80.93.62.91 iptables -A BOTNET -j DROP -s 81.13.72.148 iptables -A BOTNET -j DROP -s 81.13.86.55 iptables -A BOTNET -j DROP -s 81.177.24.60 iptables -A BOTNET -j DROP -s 81.89.56.32 iptables -A BOTNET -j DROP -s 81.95.96.130 iptables -A BOTNET -j DROP -s 82.208.46.145 iptables -A BOTNET -j DROP -s 84.17.17.24 iptables -A BOTNET -j DROP -s 84.246.225.21 iptables -A BOTNET -j DROP -s 85.13.128.38 iptables -A BOTNET -j DROP -s 85.13.129.246 iptables -A BOTNET -j DROP -s 85.13.130.117 iptables -A BOTNET -j DROP -s 85.13.130.120 iptables -A BOTNET -j DROP -s 85.13.138.24 iptables -A BOTNET -j DROP -s 85.13.206.122 iptables -A BOTNET -j DROP -s 85.17.53.234 iptables -A BOTNET -j DROP -s 86.110.225.114 iptables -A BOTNET -j DROP -s 193.86.238.12 iptables -A BOTNET -j DROP -s 209.62.92.226 iptables -A BOTNET -j DROP -s 77.221.130.1/24 iptables -A BOTNET -j DROP -s 74.86.129.130 iptables -A BOTNET -j DROP -s 78.111.81.129 iptables -A BOTNET -j DROP -s 80.249.152.20 iptables -A BOTNET -j DROP -s 81.201.28.101 ###SYN FLOOD iptables -F syn-flood iptables -N syn-flood #iptables -A syn-flood -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -m limit --limit 5/second --limit-burst 10 -j RETURN #iptables -A syn-flood -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -j LOG --log-prefix "SYN flood: " #iptables -A syn-flood -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -j DROP iptables -A syn-flood -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "SYN flood: State " iptables -A syn-flood -p tcp ! --syn -m state --state NEW -j DROP iptables -A syn-flood -m limit --limit 10/s --limit-burst 40 -j RETURN iptables -A syn-flood -j LOG --log-prefix "SYN flood: Rate " iptables -A syn-flood -j DROP #iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 10/s --limit-burst 50 -j LOG --log-prefix "SYN flood: StateRate " #iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 10/s --limit-burst 50 -j DROP iptables -A FORWARD -i lo -j ACCEPT iptables -A FORWARD -d 127.0.0.0/8 -j REJECT iptables -A FORWARD -m state --state INVALID -j DROP iptables -A FORWARD -j BOTNET iptables -A FORWARD -p TCP --syn -j syn-flood #iptables -A FORWARD -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -m limit --limit 5/second -j ACCEPT #iptables -A FORWARD -p TCP -d 207.112.10.109/32 --dport 80 --syn -m state --state NEW -j DROP iptables -A FORWARD -j ACCEPT ############### #Other Subnets# ############### route add -net 207.112.13.176/28 br0