Re-introduce rate limits on the firewall

This commit is contained in:
Bob Mottram 2017-04-25 13:45:44 +01:00
parent 38072abc54
commit bde41a1f21
2 changed files with 28 additions and 0 deletions

View File

@ -482,4 +482,29 @@ function firewall_drop_spoofed_packets {
mark_completed $FUNCNAME mark_completed $FUNCNAME
} }
function firewall_rate_limits {
if [[ $(is_completed $FUNCNAME) == "1" ]]; then
return
fi
# Limit connections per source IP
iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset
# Limit RST packets
iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
# Limit new TCP connections per second per source IP
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP
# SSH brute-force protection
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
function_check save_firewall_settings
save_firewall_settings
mark_completed $FUNCNAME
}
# NOTE: deliberately no exit 0 # NOTE: deliberately no exit 0

View File

@ -567,6 +567,9 @@ function setup_firewall {
function_check firewall_drop_spoofed_packets function_check firewall_drop_spoofed_packets
firewall_drop_spoofed_packets firewall_drop_spoofed_packets
function_check firewall_rate_limits
firewall_rate_limits
function_check configure_firewall_for_dns function_check configure_firewall_for_dns
configure_firewall_for_dns configure_firewall_for_dns