iptables 过滤字符串

1. 开启iptables

iptables -P OUTPUT ACCEPT       ###允许输出链

service iptables save                            ###保存规则

###切记注意执行顺序，防止自己被拒

2.设置开机自启动iptables

chkconfig iptables on

3.设置要禁止的字符串

iptables -A INPUT -m string --algo kmp --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" -j DROP

iptables -A INPUT -m string --algo bm --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" -j DROP

 iptables  -I   INPUT   -p   all   -s x.x.x.x  -j   DROP ###xxxx为IP

###”8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk”为要禁止的字符串

###iptables -t raw -A PREROUTING -p udp --dport 53 -m string --algo bm --hex-string "|对应域名的十六进制|" -j DROP 十六进制

4.保存规则

service iptables save

 

 

  Erasing    : libvirt-devel-0.10.2-18.el6.i686                                                                                                  1/5

  Erasing    : libvirt-java-devel-0.4.9-1.el6.noarch                                                                                             2/5

  Erasing    : libvirt-java-0.4.9-1.el6.noarch                                                                                                   3/5

  Erasing    : libvirt-client-0.10.2-18.el6.i686                                                                                                 4/5

  Erasing    : nc-1.84-24.el6.i686                                                                                                               5/5

  Verifying  : libvirt-java-devel-0.4.9-1.el6.noarch                                                                                             1/5

  Verifying  : libvirt-devel-0.10.2-18.el6.i686                                                                                                  2/5

  Verifying  : nc-1.84-24.el6.i686                                                                                                               3/5

  Verifying  : libvirt-client-0.10.2-18.el6.i686                                                                                                 4/5

  Verifying  : libvirt-java-0.4.9-1.el6.noarch                        

 

 yum -y install libvirt-devel-0.10.2-18.el6.i686 libvirt-java-devel-0.4.9-1.el6.noarch libvirt-java-0.4.9-1.el6.noarch libvirt-client-0.10.2-18.el6.i686

 

 wget

 

 

#ipatbles

iptables  -I   INPUT   -p   all   -s 58.54.199.2   -j   DROP

 

####①-

-A INPUT -m string --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" --algo kmp --to 65535 -j DROP

-A INPUT -m string --string "NODPxbCNkzQSLLjXeaBJqhDGMytfHievkLZBVYgVOTuMdiIwkilyClCLnURJIpOkBYrbocDAweGpUAxaU" --algo kmp --to 65535 -j DROP

-A INPUT -m string --string "8dVHYFDfVEvoCBkxpmcqfBiTlhnJPPXOZKPQJCEeCZzUZWqPggeOMUVrk" --algo bm --to 65535 -j DROP

-A INPUT -m string --string "NODPxbCNkzQSLLjXeaBJqhDGMytfHievkLZBVYgVOTuMdiIwkilyClCLnURJIpOkBYrbocDAweGpUAxaU" --algo bm --to 65535 -j DROP

####②-SYN_RECV 

iptables -N syn-flood 

iptables -A INPUT -p tcp --syn -j syn-flood

iptables -A syn-flood  -p tcp -m limit --limit 2/s --limit-burst 50 -j RETURN

iptables -A syn-flood -j DROP

 

@

iptables -A INPUT -m string --string "@" --algo kmp --to 65535 -j DROP

iptables -A INPUT -m string --string "@" --algo bm --to 65535 -j DROP

 

 

218.85.139.248 9977

 

 

 

 

 

iptables -N syn-flood

iptables -A FORWARD -p tcp --syn -j syn-flood

iptables -A INPUT -p tcp --syn -j syn-flood

iptables -A syn-flood -p tcp --syn -m limit --limit 3/s --limit-burst 1 -j ACCEPT

iptables -A syn-flood -j DROP

iptables -A INPUT -i eth4 -p tcp ! --syn -m state --state NEW -j DROP

iptables -A INPUT -p tcp --syn -m state --state NEW -j DROP

iptables -A INPUT -p tcp --dport 10000 -m recent --name BAD_HTTP_ACCESS --update --seconds 60 --hitcount 30 -j REJECT

iptables -A INPUT -p tcp --dport 10000 -m recent --name BAD_HTTP_ACCESS --set -j ACCEPT

 

iptables -A INPUT -m string --algo bm --hex-string "|00 00 25 9a 00 00 00 00 00 00 00 00|" -j DROP

iptables -A INPUT -m string --algo kmp --hex-string "|00 00 25 9a 00 00 00 00 00 00 00 00|" -j DROP