|
发表于 2007-12-6 18:18:18
|
显示全部楼层
我来添两句。
# Local Custom Firewall rules
# Level 7 Filtering example:
iptables -t mangle -A POSTROUTING -m layer7 --l7proto edonkey -j DROP
iptables -t mangle -A POSTROUTING -m layer7 --l7proto bittorrent -j DROP
# Attention: To enable the commands below can cause some side effects
# Syn-flood and DOS protection
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
# Port Scanners protection
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags ALL SYN,ACK -j DROP
# Ping-of-dead protection
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# Speed UP DNS
iptables -t mangle -A OUTPUT -p udp --dport 53 -j TOS --set-tos 0x08
iptables -t mangle -A PREROUTING -p udp --dport 53 -j TOS --set-tos 0x10
# Speed UP HTTP
iptables -t mangle -A OUTPUT -p tcp -j TOS --sport 80 --set-tos 0x08
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TOS --set-tos 0x08
iptables -t mangle -A OUTPUT -p tcp -j TOS --sport 80 --set-tos 0x10 |
|