Помогите разобраться с правилом iptables

вот рабочий кусок. там в конце можете посмотреть как считается.

#!/bin/sh # # SIP DoS mitigation script using Linux iptables/netfilter # WILL NOT WORK WITH SIP TLS, FOR OBVIOUS REASONS... # Copyright 2008 Kristian Kielhofner <kkielhofner@star2star.com> # changed by arheops@gmail.com 2011 # This program is distributed under the terms of the GNU Public License V2 # # TODO: Use the state module for TCP (maybe even UDP)? # TODO: Evaluate string matching algorithms and offsets # TODO: Better matching for URIs (support tel:)? # TODO: Tweak and/or provide configuration for hashlimit expires and bursts # TODO: Support configuration of INVITE/REGISTER/etc limits and methods # TODO: Don't always clear INPUT/FORWARD tables - allow for other rulesets # TODO: Testing? # INVITE rate, per host. Remember a successful (authenticated) call requires 2 INVITEs- # Initial INVITE, 407 auth required (w/ nonce), INVITE with nonce and authentication. IRATE=50/minute # REGISTER rate, per host. RRATE=10/minute # All other SIP methods rate, per host. Be careful with SUBSCRIBEs, OPTIONS, CANCELs, etc. ORATE=60/minute # Methods for this script to ignore. These SIP methods are always allowed. IGMETH="OPTIONS NOTIFY" # Burst BURST=20 # Interface(s) to protect on INPUT. Seperate multiple interfaces with spaces. # This will protect SIP services on THIS HOST. IFACE="eth0" # Reject/drop action - usually something like DROP or REJECT. # Use ACCEPT to use this script to not filter traffic but still collect statistics. DACTION=DROP # Protocol(s) to filter - can be either tcp or udp or both. Seperate multiples with spaces. PROTOCOLS="udp" # Enable logging. LOG=YES # Block tel: URIs completely? # P.S. - tel: sucks! BLOCKTEL=yes # Interface(s) to protect on FORWARD. Seperate multiple interfaces with spaces. # The same hashtable will protect the entire network from the same host(s). # Destination IP is NOT taken into consideration. # This will protect any SIP services running on the network that uses this machine # as a router (as long as you get the interfaces right). FIFACE="eth0" # Location of iptables binary. IPTABLES=`which iptables` # Search packet to this location. A larger offset looks further into the packet # and takes more time but could catch more attacks (and false alarms). # Remember, the method to match on is always in the beginning of the packet. OFFSET=65 # SIP port SPORT=5060 SSHPORT=22 if [ ! "$1" ] then echo "SIP DoS/DDoS mitigation script for iptables See top of script for configuration Usage: $0 [start|stop|status]" exit 1 fi if [ "$1" = "status" ] then $IPTABLES -L -v -n exit fi # Setup iptables for i in sipdos sshdos whitelist blacklist sipdosregister sipdosinvite fail2ban-sip do $IPTABLES -F $i 2> /dev/null $IPTABLES -X $i 2> /dev/null $IPTABLES -N $i 2> /dev/null done; if [ "$1" = "stop" ] then echo "Clearing iptables rules..." if [ "$FIFACE" ] then $IPTABLES -F FORWARD 2> /dev/null fi $IPTABLES -F INPUT 2> /dev/null exit fi # Send the right traffic through our chain for i in $IFACE do for l in $PROTOCOLS do $IPTABLES -D INPUT -i $i -m $l -p $l --dport $SPORT -j sipdos 2>/dev/null $IPTABLES -D INPUT -i $i -m $l -p $l --dport $SPORT -j sipdos 2>/dev/null $IPTABLES -A INPUT -i $i -m $l -p $l --dport $SPORT -j sipdos done done # Send the right forwarded traffic through our chain if [ "$FIFACE" ] then for j in $FIFACE do for l in $PROTOCOLS do $IPTABLES -D INPUT -m $l -p $l --dport $SPORT -j sipdos $IPTABLES -I INPUT -m $l -p $l --dport $SPORT -j sipdos done done fi for i in `cat /etc/block/blacklist` do $IPTABLES -I blacklist -s $i -j REJECT --reject-with icmp-host-unreachable done; for i in `cat /etc/block/whitelist` do $IPTABLES -A whitelist -s $i -j ACCEPT $IPTABLES -A whitelist -d $i -j ACCEPT done; $IPTABLES -A whitelist -s 78.47.159.176/28 -j ACCEPT $IPTABLES -A sipdos -j fail2ban-sip $IPTABLES -A sipdos -j blacklist $IPTABLES -A sipdos -j whitelist # "Handle" tel: URIs if [ "$BLOCKTEL" ] then $IPTABLES -A sipdos -m string --string "tel:" --algo bm --to $OFFSET -j $DACTION fi # Ignore certain (configured) methods if [ "$IGMETH" ] then for k in $IGMETH do $IPTABLES -A sipdos -m string --string "$k sip:" --algo bm --to $OFFSET -j ACCEPT done fi # Finally set some limits... # INVITE limit $IPTABLES -A sipdos -m string --string "INVITE sip:" --algo bm --to $OFFSET -j sipdosinvite $IPTABLES -A sipdosinvite \ -m hashlimit --hashlimit $IRATE --hashlimit-burst $BURST \ --hashlimit-mode srcip,dstport --hashlimit-name sip_i_limit -j ACCEPT # REGISTER limit $IPTABLES -A sipdos -m string --string "REGISTER sip:" --algo bm --to $OFFSET -j sipdosregister $IPTABLES -A sipdosregister \ -m hashlimit --hashlimit $RRATE --hashlimit-burst $BURST \ --hashlimit-mode srcip,dstport --hashlimit-name sip_r_limit -j ACCEPT # All other SIP packets... $IPTABLES -A sipdos -m hashlimit --hashlimit $ORATE --hashlimit-burst $BURST \ --hashlimit-mode srcip,dstport --hashlimit-name sip_o_limit -j ACCEPT # Take action on everything else if [ $LOG ] then $IPTABLES -A sipdosregister -j LOG --log-prefix SIP_TO_MANY $IPTABLES -A sipdosinvite -j LOG --log-prefix SIP_TO_MANY fi $IPTABLES -A sipdosregister -j $DACTION $IPTABLES -A sipdosinvite -j $DACTION 

Прежде чем начинать работать с iptables посоветую зайти на www.opennet.ru Там есть очень много примеров.

Сделайте следующее:

1. создайте фаил с именем iptables.ok

2. скопируйте следующее в этот фаил (может вам нужно видоизменить даный код)

    # Generated by iptables-save v1.4.2 on Tue Nov 16 10:00:55 2010 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :SCAMBLOCK - [0:0] # Jump to SCAMBLOCK chain to check connection to 5060 udp port -A INPUT -p udp —dport 5060 -j SCAMBLOCK # Returning after SCAMBLOCK chain -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "SYN Not New:" -A INPUT -p tcp -m tcp ! --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP -A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "Packet died: " --log-level 7 -A INPUT -p icmp -m icmp --icmp-type 8 -m length --length 128:65535 -j LOG --log-prefix "ICMP Oversize:" --log-level 7 -A INPUT -p icmp -m icmp --icmp-type 8 -m length --length 128:65535 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 3/sec -j ACCEPT -A INPUT -p icmp -f -j LOG --log-prefix "ICMP Fagment:" -A INPUT -p icmp -f -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -m tcp --dport 3306 -j LOG --log-prefix "TCP Try connect MySQL server:" -A INPUT -p tcp -m tcp --dport 3306 -j REJECT --reject-with icmp-host-prohibited -A INPUT -p udp -m udp --dport 3306 -j LOG --log-prefix "UDP Try connect MySQL server:" -A INPUT -p udp -m udp --dport 3306 -j REJECT --reject-with icmp-host-prohibited -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A INPUT -j DROP #SCAMBLOCK chain for cheking udp 5060 port -A SCAMBLOCK -p udp —dport 5060 -m recent —set —name SIP -A SCAMBLOCK -p udp —dport 5060 -m recent —update —seconds 2 —hitcount 60 —name SIP -j LOG —log-prefix «SIP flood detected:» -A SCAMBLOCK -p udp —dport 5060 -m recent —update —seconds 2 —hitcount 60 —name SIP -j REJECT --reject-with icmp-port-unreachable #Return to INPUT chain -A SCAMBLOCK -j RETURN COMMIT # Completed on Tue Nov 16 10:00:55 2010 

3. потом iptables-restore < <имя файла>

4. я прописал это "iptables-restore < <имя файла>" в rc.local. У меня Дебиян.

Посмотрите в сторону fail2ban. Про него много написано и под разные Linux дистрибутивы