Iptables

1: Drop invalid packets

/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

2: Drop TCP packets that are new and are not SYN

/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

3: Drop SYN packets with suspicious MSS value

/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

4: Block packets with bogus TCP flags

/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP /sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

5: Block spoofed packets

/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP /sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP

6: Drop ICMP (you usually don't need this protocol)

/sbin/iptables -t mangle -A PREROUTING -p icmp -j DROP

7: Drop fragments in all chains

/sbin/iptables -t mangle -A PREROUTING -f -j DROP

8: Limit connections per source IP

/sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset

9: Limit RST packets

/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT /sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP

10: Limit new TCP connections per second per source IP

/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT /sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP

11: Use SYNPROXY on all ports (disables connection limiting rule)

Hidden - unlock content above in "Mitigating SYN Floods With SYNPROXY" section

-A INPUT -i lo -j ACCEPT -A INPUT -s 212.147.52.214 -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp --syn -m connlimit --connlimit-above 50 --connlimit-mask 32 -j REJECT --reject-with tcp-reset -m comment --comment "Limit 50 conns for each IP" -A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT -m comment --comment "Allow Ping" -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP -A INPUT -i eth1 -s 169.254.0.0/16 -j DROP -A INPUT -i eth1 -s 172.16.0.0/12 -j DROP -A INPUT -i eth1 -s 192.0.2.0/24 -j DROP -A INPUT -i eth1 -s 192.168.0.0/16 -j DROP -A INPUT -i eth1 -s 224.0.0.0/4 -j DROP -A INPUT -i eth1 -s 240.0.0.0/5 -j DROP -A INPUT -i eth1 -d 127.0.0.0/8 -j DROP -A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP -A INPUT -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP -A INPUT -p tcp --tcp-flags RST RST -j DROP -A INPUT -p udp -m conntrack --ctstate NEW -j ADMIN -A INPUT -p tcp --syn -m conntrack --ctstate NEW -jADMIN -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -j LOG_AND_DROP -A LOG_AND_DROP -m limit --limit 2/min -j LOG --log-prefix "iptables deny: " --log-level 7 -A LOG_AND_DROP -j DROP -A ADMIN -p tcp -m tcp --dport 42660 -j ACCEPT -A ADMIN -p tcp -m tcp --dport 80 -j ACCEPT -A ADMIN -p tcp -m tcp --dport 443 -j ACCEPT -A ADMIN -p tcp -m tcp --dport 6881:6890 -j ACCEPT -A ADMIN -j REJECT