Block DoS/DDoS attacks using IPTables in SSH

[sniffdog]

Also missing, how to ban a whole range of IPs

iptables -I INPUT -s 110.0.0.0/255.0.0.0 -j DROP

This would ban all IPs in the 110 IP range ...

Often it's very difficult which IPs to ban. For myself, as a Rapidleech provider, I get a lot of 1 connection IPs.

It's often difficult to see if these are really 'Brute Force Attacks' or being used by file hosts either by multifetch and/or regular down/upload.

A handy tool to check where IPs come from:

http://geotool.servehttp.com

/

[Royal King]

Wow man. This will surely help. Thanks for this.

[Pr0nZtrA]

1 lame question: how do i ssh?

more lame questions to come

[Gavo]

isn't it a bad idea to save the blocks to iptables, ddos attacks are usually temporary and after some time your going to have huge tables running and slowing things down.
Also you may be permanently banning a legit ip by mistake.

That's why i like ddosDeflate as it temporary bans IP's

[DXS]

You don't have to save it, but you can..

Also, that's why theres the unban option....

[scuba_steve]

Thanks will have to use this soon.

[gmaister22]

thanks m8

[m107]

nice tips, thank you.

[soum111]

very usefull

[omgtfl]

For DDoS this is useless, you can ban the ip, but the packet will still saturate your connection, there is no way to stop DDoS only with Iptables....