Como prevenir ataques DDOS con el firewall CSF?

Este artículo te ayuda a establecer el cortafuegos CSF para prevenir ataques DDOS contra su servidor.

 

Paso 1: Abre y edita el configurador de CSF

vi /etc/csf/csf.conf

Settings:

Enable connection tracking.
CT_LIMIT is max number of connection allowed from one IP, you can set this value as per your server requirement.

CT_LIMIT =100
Set connection tracking interval.

CT_INTERVAL =30
If you want to get possible ddos attack email then enable it.

CT_EMAIL_ALERT =1
If you want to make IP blocks permanent then set this to 1, otherwise blocks
will be temporary and will be cleared after CT_BLOCK_TIME seconds

CT_PERMANENT = 1
If you opt for temporary IP blocks for CT, then the following is the interval
in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)

CT_BLOCK_TIME = 36000
If you only want to count specific ports (e.g. 80,443) then add the ports
to the following as a comma separated list. E.g. “80,443”

CT_PORTS = 80,23,443

These settings will be enough for DDOS attacks but if you are getting more attacks even you have above option configured then we can set few more options.

 

Step 2: Enable distributed attacks

LF_DISTATTACK = 1
Set the following to the minimum number of unique IP addresses that trigger
LF_DISTATTACK

LF_DISTATTACK_UNIQ = 2

Step 3: Enable distributed FTP attacks

LF_DISTFTP = 1

Set the following to the minimum number of unique IP addresses that trigger
LF_DISTFTP. LF_DISTFTP_UNIQ must be <= LF_DISTFTP for this to work

LF_DISTFTP_UNIQ = 3

If this option is set to 1 the blocks will be permanent
If this option is > 1, the blocks will be temporary for the specified number
of seconds

LF_DISTFTP_PERM =1

Step 4: Enable distributed SMTP attacks.

 

LF_DISTSMTP =1

Set the following to the minimum number of unique IP addresses that trigger
LF_DISTSMTP. LF_DISTSMTP_UNIQ must be <= LF_DISTSMTP for this to work

LF_DISTSMTP_UNIQ =4

If this option is set to 1 the blocks will be permanent
If this option is > 1, the blocks will be temporary for the specified number
of seconds

LF_DISTSMTP_PERM =1

This is the interval during which a distributed FTP or SMTP attack is
measured

LF_DIST_INTERVAL = 300

  • 1 کاربر این را مفید یافتند
آیا این پاسخ به شما کمک کرد؟