iptables -I INPUT -s 61.214.143.232 -j DROP
iptables -I INPUT -s 123.81.232.45 -j DROP
iptables -I INPUT -s 119.5.68.82 -j DROP
iptables -I INPUT -s 114.83.66.254 -j DROP
iptables -I INPUT -s 118.249.164.26 -j DROP
iptables -I INPUT -s 203.130.120.90 -j DROP
iptables -I INPUT -s 58.247.137.222 -j DROP
iptables -I INPUT -s 121.231.184.18 -j DROP
iptables -I INPUT -s 124.229.19.186 -j DROP
iptables -I INPUT -s 59.48.244.74 -j DROP
iptables -I INPUT -s 222.181.83.37 -j DROP
iptables -I INPUT -s 60.214.49.12 -j DROP
iptables -I INPUT -s 222.221.220.70 -j DROP
iptables -I INPUT -s 218.58.13.200 -j DROP
iptables -I INPUT -s 114.83.71.40 -j DROP
iptables -I INPUT -s 123.153.135.71 -j DROP
iptables -I INPUT -s 218.72.149.54 -j DROP
iptables -I INPUT -s 114.101.215.5 -j DROP
iptables -I INPUT -s 114.105.39.28 -j DROP
iptables -I INPUT -s 116.208.73.38 -j DROP
iptables -I INPUT -s 59.34.74.174 -j DROP
iptables -I INPUT -s 121.19.169.184 -j DROP
iptables -I INPUT -s 118.250.172.134 -j DROP
iptables -I INPUT -s 115.46.179.64 -j DROP
iptables -I INPUT -s 206.246.186.30 -j DROP
iptables -I INPUT -s 218.246.177.138 -j DROP
iptables -I INPUT -s 121.31.123.8 -j DROP
iptables -I INPUT -s 220.172.230.87 -j DROP
iptables -I INPUT -s 206.246.186.30 -j DROP
iptables -I INPUT -s 121.178.242.172 -j DROP
iptables -I INPUT -s 123.194.135.180 -j DROP
iptables -I INPUT -s 60.43.85.239 -j DROP
iptables -I INPUT -s 121.178.242.93 -j DROP
iptables -I INPUT -s 115.161.200.117 -j DROP
iptables -I INPUT -s 123.153.141.189 -j DROP
iptables -I INPUT -s 221.201.47.204 -j DROP
iptables -I INPUT -s 115.128.65.137 -j DROP
iptables -I INPUT -s 60.210.47.93 -j DROP
iptables -I INPUT -s 121.31.123.8 -j DROP
iptables -I INPUT -s 116.46.242.99 -j DROP
iptables -I INPUT -s 114.83.76.131 -j DROP
iptables -I INPUT -s 218.22.117.98 -j DROP
iptables -I INPUT -s 61.149.111.226 -j DROP
iptables -I INPUT -s 116.9.98.2 -j DROP
iptables -I INPUT -s 60.214.55.14 -j DROP
iptables -I INPUT -s 203.130.120.107 -j DROP
iptables -I INPUT -s 121.19.191.214 -j DROP
iptables -I INPUT -s 60.180.7.182 -j DROP
iptables -I INPUT -s 59.34.98.161 -j DROP
iptables -I INPUT -s 218.59.103.217 -j DROP
iptables -I INPUT -s 119.132.103.110 -j DROP
iptables -I INPUT -s 222.181.82.85 -j DROP
iptables -I INPUT -s 116.114.229.70 -j DROP
iptables -I INPUT -s 218.59.157.217 -j DROP
iptables -I INPUT -s 119.132.103.110 -j DROP
iptables -I INPUT -s 122.89.58.41 -j DROP
iptables -I INPUT -s 114.178.132.244 -j DROP
iptables -I INPUT -s 121.231.183.237 -j DROP
iptables -I INPUT -s 219.145.221.32 -j DROP
iptables -I INPUT -s 221.2.116.32 -j DROP
iptables -I INPUT -s 218.59.103.217 -j DROP
iptables -I INPUT -s 84.110.204.213 -j DROP
iptables -I INPUT -s 60.168.246.17 -j DROP
iptables -I INPUT -s 61.130.196.57 -j DROP
iptables -I INPUT -s 218.59.157.217 -j DROP
iptables -I INPUT -s 221.131.61.46 -j DROP
iptables -I INPUT -s 120.7.186.56 -j DROP
iptables -I INPUT -s 116.208.61.187 -j DROP
iptables -I INPUT -s 70.252.148.149 -j DROP
iptables -I INPUT -s 123.81.233.88 -j DROP
iptables -I INPUT -s 119.122.89.114 -j DROP
iptables -I INPUT -s 116.54.5.167 -j DROP
iptables -I INPUT -s 218.81.181.227 -j DROP
iptables -I INPUT -s 58.60.202.76 -j DROP
iptables -I INPUT -s 60.163.132.183 -j DROP
iptables -I INPUT -s 114.167.233.170 -j DROP
iptables -I INPUT -s 61.47.195.136 -j DROP
iptables -I INPUT -s 114.83.67.6 -j DROP
iptables -I INPUT -s 118.249.142.195 -j DROP
iptables -I INPUT -s 202.103.228.252 -j DROP
iptables -I INPUT -s 219.145.202.105 -j DROP
iptables -I INPUT -s 59.36.236.229 -j DROP
iptables -I INPUT -s 121.19.164.144 -j DROP
iptables -I INPUT -s 114.235.84.25 -j DROP
iptables -I INPUT -s 222.125.132.197 -j DROP
iptables -I INPUT -s 110.6.78.99 -j DROP
iptables -I INPUT -s 110.6.78.99 -j DROP
iptables -I INPUT -s 119.5.69.12 -j DROP
iptables -I INPUT -s 60.215.113.167 -j DROP
iptables -I INPUT -s 122.48.190.206 -j DROP
iptables -I INPUT -s 121.16.84.78 -j DROP
iptables -I INPUT -s 124.134.20.221 -j DROP
iptables -I INPUT -s 221.137.251.191 -j DROP
iptables -I INPUT -s 116.112.111.53 -j DROP
iptables -I INPUT -s 219.236.17.54 -j DROP
iptables -I INPUT -s 117.69.48.102 -j DROP
iptables -I INPUT -s 117.69.48.102 -j DROP
iptables -I INPUT -s 116.208.67.148 -j DROP
iptables -I INPUT -s 119.122.89.161 -j DROP
iptables -I INPUT -s 219.134.40.85 -j DROP
iptables -I INPUT -s 58.8.153.44 -j DROP
iptables -I INPUT -s 222.71.219.79 -j DROP
iptables -I INPUT -s 202.109.132.203 -j DROP
iptables -I INPUT -s 180.0.155.180 -j DROP
iptables -I INPUT -s 114.83.96.55 -j DROP
iptables -I INPUT -s 123.122.73.217 -j DROP
iptables -I INPUT -s 124.229.26.146 -j DROP
iptables -I INPUT -s 222.185.75.88 -j DROP
iptables -I INPUT -s 116.208.64.148 -j DROP
iptables -I INPUT -s 115.128.46.67 -j DROP
iptables -I INPUT -s 119.123.168.241 -j DROP
iptables -I INPUT -s 116.24.235.26 -j DROP
iptables -I INPUT -s 60.21.122.30 -j DROP
iptables -I INPUT -s 120.3.124.79 -j DROP
iptables -I INPUT -s 116.112.98.102 -j DROP
iptables -I INPUT -s 123.81.229.99 -j DROP
iptables -I INPUT -s 111.120.10.208 -j DROP
iptables -I INPUT -s 81.193.58.160 -j DROP
iptables -I INPUT -s 121.19.177.141 -j DROP
iptables -I INPUT -s 124.64.213.242 -j DROP
iptables -I INPUT -s 114.105.43.98 -j DROP
iptables -I INPUT -s 118.74.42.131 -j DROP
iptables -I INPUT -s 119.86.151.220 -j DROP
iptables -I INPUT -s 121.205.224.21 -j DROP
iptables -I INPUT -s 111.176.4.178 -j DROP
iptables -I INPUT -s 121.205.244.21 -j DROP
iptables -I INPUT -s 221.217.81.165 -j DROP
iptables -I INPUT -s 222.181.80.183 -j DROP
iptables -I INPUT -s 81.110.87.110 -j DROP
iptables -I INPUT -s 61.149.118.64 -j DROP
iptables -I INPUT -s 84.110.87.110 -j DROP
iptables -I INPUT -s 115.161.200.49 -j DROP
iptables -I INPUT -s 121.19.176.45 -j DROP
iptables -I INPUT -s 220.249.194.176 -j DROP
iptables -I INPUT -s 221.5.86.5 -j DROP
iptables -I INPUT -s 110.6.86.137 -j DROP
iptables -I INPUT -s 219.134.51.17 -j DROP
iptables -I INPUT -s 116.114.246.18 -j DROP
iptables -I INPUT -s 112.66.6.188 -j DROP
iptables -I INPUT -s 84.110.51.24 -j DROP
iptables -I INPUT -s 125.123.149.194 -j DROP
iptables -I INPUT -s 124.116.82.219 -j DROP
iptables -I INPUT -s 112.66.8.9 -j DROP
iptables -I INPUT -s 59.50.24.35 -j DROP
iptables -I INPUT -s 218.81.181.100 -j DROP
iptables -I INPUT -s 122.94.109.157 -j DROP
iptables -I INPUT -s 115.161.197.245 -j DROP
iptables -I INPUT -s 222.188.228.77 -j DROP
iptables -I INPUT -s 117.69.51.233 -j DROP
iptables -I INPUT -s 114.83.67.144 -j DROP
iptables -I INPUT -s 114.105.41.209 -j DROP
iptables -I INPUT -s 222.181.85.130 -j DROP
iptables -I INPUT -s 114.167.236.157 -j DROP
iptables -I INPUT -s 124.73.49.200 -j DROP
iptables -I INPUT -s 116.16.139.29 -j DROP
iptables -I INPUT -s 125.113.168.182 -j DROP
iptables -I INPUT -s 114.101.233.117 -j DROP
iptables -I INPUT -s 60.214.62.179 -j DROP
iptables -I INPUT -s 219.237.222.130 -j DROP
iptables -I INPUT -s 121.206.185.111 -j DROP
iptables -I INPUT -s 111.176.4.94 -j DROP
iptables -I INPUT -s 124.116.86.220 -j DROP
iptables -I INPUT -s 59.48.248.56 -j DROP
iptables -I INPUT -s 125.85.136.174 -j DROP
iptables -I INPUT -s 61.163.226.76 -j DROP
iptables -I INPUT -s 122.230.64.211 -j DROP
iptables -I INPUT -s 119.84.167.19 -j DROP
iptables -I INPUT -s 60.168.225.180 -j DROP
iptables -I INPUT -s 116.230.64.121 -j DROP
iptables -I INPUT -s 124.229.31.85 -j DROP
iptables -I INPUT -s 219.236.251.228 -j DROP
iptables -I INPUT -s 211.160.255.46 -j DROP
iptables -I INPUT -s 113.27.130.248 -j DROP
iptables -I INPUT -s 119.100.12.123 -j DROP
iptables -I INPUT -s 116.208.62.178 -j DROP
iptables -I INPUT -s 219.139.192.25 -j DROP
iptables -I INPUT -s 219.236.217.158 -j DROP
iptables -I INPUT -s 119.86.144.159 -j DROP
iptables -I INPUT -s 28.60.165.249 -j DROP
iptables -I INPUT -s 219.134.39.127 -j DROP
iptables -I INPUT -s 110.43.49.6 -j DROP
iptables -I INPUT -s 114.235.75.4 -j DROP
iptables -I INPUT -s 121.231.185.235 -j DROP
iptables -I INPUT -s 117.84.177.172 -j DROP
iptables -I INPUT -s 58.143.154.37 -j DROP
iptables -I INPUT -s 119.5.70.77 -j DROP
iptables -I INPUT -s 59.48.244.118 -j DROP
iptables -I INPUT -s 114.101.210.132 -j DROP
iptables -I INPUT -s 60.168.242.224 -j DROP
iptables -I INPUT -s 116.4.129.181 -j DROP
iptables -I INPUT -s 119.100.1.99 -j DROP
iptables -I INPUT -s 125.67.31.12 -j DROP
iptables -I INPUT -s 114.83.77.142 -j DROP
iptables -I INPUT -s 116.30.205.66 -j DROP
iptables -I INPUT -s 218.72.148.254 -j DROP
iptables -I INPUT -s 116.208.74.29 -j DROP
iptables -I INPUT -s 222.181.82.205 -j DROP
iptables -I INPUT -s 118.250.86.219 -j DROP
iptables -I INPUT -s 119.182.188.159 -j DROP
iptables -I INPUT -s 121.234.224.197 -j DROP
iptables -I INPUT -s 60.21.119.155 -j DROP
iptables -I INPUT -s 124.229.8.227 -j DROP
iptables -I INPUT -s 180.0.157.84 -j DROP
iptables -I INPUT -s 220.165.131.234 -j DROP
iptables -I INPUT -s 116.54.47383 -j DROP
iptables -I INPUT -s 123.81.231.113 -j DROP
iptables -I INPUT -s 114.83.69.56 -j DROP
iptables -I INPUT -s 116.4.126.162 -j DROP
iptables -I INPUT -s 60.168.236.204 -j DROP
iptables -I INPUT -s 222.57.72.127 -j DROP
iptables -I INPUT -s 119.86.98.52 -j DROP
iptables -I INPUT -s 61.47.209.169 -j DROP
iptables -I INPUT -s 68.127.50.240 -j DROP
iptables -I INPUT -s 119.5.70.174 -j DROP
iptables -I INPUT -s 60.210.57.81 -j DROP
iptables -I INPUT -s 59.48.244.245 -j DROP
iptables -I INPUT -s 116.114.240.155 -j DROP
iptables -I INPUT -s 114.234.22.59 -j DROP
iptables -I INPUT -s 119.100.9.135 -j DROP
iptables -I INPUT -s 220.242.75.216 -j DROP
iptables -I INPUT -s 121.231.182.174 -j DROP
iptables -I INPUT -s 124.73.3.80 -j DROP
iptables -I INPUT -s 222.247.177.120 -j DROP
iptables -I INPUT -s 61.141.129.220 -j DROP
iptables -I INPUT -s 121.12.63.87 -j DROP
iptables -I INPUT -s 117.69.50.253 -j DROP
iptables -I INPUT -s 121.231.182.143 -j DROP
iptables -I INPUT -s 120.7.183.142 -j DROP
iptables -I INPUT -s 114.105.33.122 -j DROP
iptables -I INPUT -s 114.83.79.238 -j DROP
iptables -I INPUT -s 112.66.4.200 -j DROP
iptables -I INPUT -s 118.120.42.208 -j DROP
iptables -I INPUT -s 120.14.7.99 -j DROP
iptables -I INPUT -s 114.235.73.53 -j DROP
iptables -I INPUT -s 59.36.232.131 -j DROP
iptables -I INPUT -s 116.3.252.35 -j DROP
iptables -I INPUT -s 219.236.18.44 -j DROP
iptables -I INPUT -s 211.237.219.190 -j DROP
iptables -I INPUT -s 114.88.73.182 -j DROP
iptables -I INPUT -s 116.16.144.37 -j DROP
iptables -I INPUT -s 59.36.238.246 -j DROP
iptables -I INPUT -s 121.19.72.57 -j DROP
iptables -I INPUT -s 61.189.228.31 -j DROP
iptables -I INPUT -s 121.231.182.143 -j DROP
iptables -I INPUT -s 120.7.183.142 -j DROP
iptables -I INPUT -s 114.105.33.122 -j DROP
iptables -I INPUT -s 114.83.79.238 -j DROP
iptables -I INPUT -s 112.66.4.200 -j DROP
iptables -I INPUT -s 118.120.42.208 -j DROP
iptables -I INPUT -s 120.14.7.99 -j DROP
iptables -I INPUT -s 114.235.73.53 -j DROP
iptables -I INPUT -s 59.36.232.131 -j DROP
iptables -I INPUT -s 116.3.252.35 -j DROP
iptables -I INPUT -s 219.236.18.44 -j DROP
iptables -I INPUT -s 211.237.219.190 -j DROP
iptables -I INPUT -s 114.88.73.182 -j DROP
iptables -I INPUT -s 116.16.144.37 -j DROP
iptables -I INPUT -s 59.36.238.246 -j DROP
iptables -I INPUT -s 121.19.72.57 -j DROP
iptables -I INPUT -s 61.189.228.31 -j DROP
iptables -I INPUT -s 116.208.62.177 -j DROP
iptables -I INPUT -s 79.135.208.143 -j DROP
iptables -I INPUT -s 119.86.124.14 -j DROP
iptables -I INPUT -s 84.110.193.248 -j DROP
iptables -I INPUT -s 120.142.197.225 -j DROP
iptables -I INPUT -s 58.143.153.77 -j DROP
iptables -I INPUT -s 121.234.225.129 -j DROP
iptables -I INPUT -s 112.66.15.6 -j DROP
iptables -I INPUT -s 218.15.140.247 -j DROP
iptables -I INPUT -s 116.9.21.136 -j DROP
iptables -I INPUT -s 113.73.113.201 -j DROP
iptables -I INPUT -s 110.6.65.244 -j DROP
iptables -I INPUT -s 113.240.91.110 -j DROP
iptables -I INPUT -s 121.231.177.247 -j DROP
iptables -I INPUT -s 121.16.44.26 -j DROP
iptables -I INPUT -s 60.180.181.178 -j DROP
iptables -I INPUT -s 116.114.232.3 -j DROP
iptables -I INPUT -s 116.4.130.181 -j DROP
iptables -I INPUT -s 121.206.181.176 -j DROP
iptables -I INPUT -s 219.152.36.105 -j DROP
iptables -I INPUT -s 123.10.46.238 -j DROP
iptables -I INPUT -s 119.5.70.253 -j DROP
iptables -L -n
iptables -A OUTPUT -p icmp -d 0/0 -j DROP
这个是做什么的呢，最简单直观的说就是你服务器上的ip不能被ping到了，这个能防止一部分攻击。
| |
我用的是RedHat7.2没有限制单个IP地址tcp的连接数扩展模块,于是我限制TCP连接数到来的速度 |
因为在DDOS这个过程里很多ip是伪造的，如果你能找到他们的来源的mac地址（你太厉害了，太有关系了）那么你还可以用这个命令来禁止来自这个mac地址的数据流：
iptables -A INPUT --mac-source 00:0B:AB:45:56:42 -j DROP
以上是几个简单应用，关于一些别的应用我下面给出的英文文献里还有，大家可以根据自己的情况来利用iptables防止DDOS攻击。
顺带再说一下 iptables你第一次安装后输入了一些限制规则后，你服务器在启动后还是得重新提交规则，太麻烦了，怎么办？你只要用这个命令就可以了
/etc/init.d/iptables start
iptables -I INPUT -s 114.167.248.59 -j DROP
iptables -I INPUT -s 116.34.34.248 -j DROP
iptables -I INPUT -s 61.189.228.173 -j DROP
iptables -I INPUT -s 92.113.202.26 -j DROP
iptables -I INPUT -s 116.16.139.239 -j DROP
iptables -I INPUT -s 219.152.36.152 -j DROP
iptables -I INPUT -s 61.130.203.137 -j DROP
iptables -I INPUT -s 118.75.183.243 -j DROP
iptables -I INPUT -s 121.12.52.39 -j DROP
iptables -I INPUT -s 121.206.17.203 -j DROP
iptables -I INPUT -s 222.247.210.207 -j DROP
iptables -I INPUT -s 121.19.84.211 -j DROP
iptables -I INPUT -s 116.10.226.14 -j DROP
iptables -I INPUT -s 114.83.69.203 -j DROP
iptables -I INPUT -s 110.43.46.253 -j DROP
iptables -I INPUT -s 20.165.130.74 -j DROP
iptables -I INPUT -s 123.224.127.101 -j DROP
iptables -I INPUT -s 61.146.77.131 -j DROP
iptables -I INPUT -s 119.5.69.114 -j DROP
iptables -I INPUT -s 220.165.130.74 -j DROP
iptables -I INPUT -s 124.73.36.90 -j DROP
iptables -I INPUT -s 125.39.74.66 -j DROP
iptables -I INPUT -s 58.142.156.195 -j DROP
iptables -I INPUT -s 123.182.204.27 -j DROP
iptables -I INPUT -s 119.139.86.169 -j DROP
iptables -I INPUT -s 84.110.89.184 -j DROP
iptables -I INPUT -s 114.83.76.223 -j DROP
iptables -I INPUT -s 222.181.84.185 -j DROP
iptables -I INPUT -s 123.52.101.44 -j DROP
iptables -I INPUT -s 58.23.118.64 -j DROP
iptables -I INPUT -s 58.45.44.14 -j DROP
iptables -I INPUT -s 118.172.241.23 -j DROP
iptables -I INPUT -s 60.48.197.39 -j DROP
iptables -I INPUT -s 120.7.181.50 -j DROP
iptables -I INPUT -s 61.189.108.183 -j DROP
iptables -I INPUT -s 124.226.184.222 -j DROP
iptables -I INPUT -s 121.206.181.135 -j DROP
其他参考
防止同步包洪水（Sync Flood）
# iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
也有人写作
# iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
--limit 1/s 限制syn并发数每秒1次，可以根据自己的需要修改防止各种端口扫描
# iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
Ping洪水攻击（Ping of Death）
# iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
