正文
iptables脚本封ip
提示：扫一扫查出行【扫一扫了解最新限行尾号】
复制提示
##自动封IP：分析web或应用日志或者网络连接状态封掉垃圾IP
#!/bin/sh
/bin/netstat -na|grep ESTABLISHED|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -rn|head -|grep -v -E '192.168|127.0'|awk '{if ($2!=null && $1>4) {print $2}}'>/home/shell/dropip
for i in $(cat /home/shell/dropip)
do
/sbin/iptables -I INPUT -s $i -j DROP
#-m limit --limit /min --limit-burst
echo "$i kill at `date`">>/var/log/ddos
done#!/bin/sh
## search connection established ips
netstat -an |grep EST|awk -F " " '{print $5}' |cut -d ":" -f4 |grep "[0-9]*.[0-9]*.[0-9]*.[0-9]*" |sort |uniq -c |sort -rn |head - >/home/shell/ip_connection.log
## drop ips
cat /home/shell/ip_connection.log |egrep -v "[a-z][A-Z]*" |egrep -v "202.165|192.168|127.0"|while read line
do
count=`echo $line|awk '{print $1}'`
ip=`echo $line|awk '{print $2}'`
if [ $count -ge ]
then
echo "all establish status connection > 100 ip is : $ip"
echo "apply rule ,drop $ip access 100 !"
/sbin/iptables -I INPUT -s $ip -p tcp --dport -j DROP
/sbin/service iptables save
fi
done
