#!/bin/bash
cat /root/block.txt |while read block
do
iptables -A INPUT -p tcp -m tcp -s $block --dport 80 -j REJECT
iptables-save
/etc/rc.d/init.d/iptables-save
done
#/bin/bash
netstat -an| grep :80 | grep -v 127.0.0.1 |awk '{ print $5 }' | sort|awk -F: '{print $1,$4}' | uniq -c | awk '$1 >50 {print $1,$2}' > /root/black.txt
for i in `awk '{print $2}' /root/black.txt`
do
COUNT=`grep $i /root/black.txt | awk '{print \$1}'`
DEFINE="50"
ZERO="0"
if [ $COUNT -gt $DEFINE ];
then
grep $i /root/white.txt > /dev/null
if [ $? -gt $ZERO ];
then
echo "$COUNT $i"
iptables -I INPUT -p tcp -s $i -j DROP
fi
fi
done
iptables -I INPUT -p tcp --dport 80 -m connlimit --connlimit-above 10 -j DROP 限制单个地址并发连接数不大于50
iptables -I INPUT -p tcp --dport 80 -m connlimit --connlimit-above 10 --connlimit-mask 24 -j DROP 限制一个C类网段的并发连接数 |
阅读(1427) | 评论(0) | 转发(0) |
