被攻击实例:请教ESTABLISHED方式的如何用iptables来防

zzw45

1、请教下面一句话是什么意思？
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


2、请教如果防止如下攻击
###################################
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1392 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1360 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1456 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1424 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1393 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1361 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1457 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1425 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1394 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1362 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1458 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1426 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1395 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1363 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1427 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1396 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1364 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1428 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1397 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1365 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1429 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:4662 TIME_WAIT   
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1398 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1366 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1430 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:4663 TIME_WAIT   
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1399 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1367 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1431 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1400 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1368 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1432 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1401 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1369 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1433 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1402 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1370 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1434 ESTABLISHED
tcp        0      0 ::ffff:61.129.53.112:80     ::ffff:221.224.114.195:1403 ESTABLISHED
###################################

springwind426

假设221.224.114.195是攻击机器
iptables -t nat -I PREROUTING 1 -s 221.224.114.195 -j DROP
iptables -t nat -I PREROUTING 1 -d 221.224.114.195 -j DROP
试试

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
是讲让已经建立的连接正常通过，通常用在缺省策略为禁止的防火墙上。

hmqq

iptables connlimit
或者用apache的mod_limitipconn模块来限制每个IP的并发连接数量

liuzhuan23

Post by hmqq
iptables connlimit
或者用apache的mod_limitipconn模块来限制每个IP的并发连接数量

正解，限制同一个IP的连接数量即可:%