Taking 10.0.0.0/24
as an example, something like
iptables -A INPUT -p tcp -s 10.0.0.0/24 --syn -m limit --limit 1/s --limit-burst 3 -j RETURN
should do the job and is quite self-descriptive, so that doesn't need any explanation I guess. Here's a good, easy to read article on how to prevent TCP SYN flood attacks: Linux Iptables Limit the number of incoming tcp connection / syn-flood attacks. It explains more about the options, and provides a more extensive way too (logging, separate chain, etc.).
I can't see the current state of your iptables
from here, so you might want to add this at the top of the INPUT
chain or integrate it properly in your current scripts.
In the comments you've mentioned you're looking for an automated way of finding these IP blocks. Well, I should just leave out the source address filter in the command (-s 10.0.0.0/8
), so the limit will apply to the whole world.
hashlimit
(iptables module) but I'm not sure how it works as almost all examples use per-port limits or per-ip limits, not per C class block limits./24
IPv4 blocks directly, imo! You will block too many innocent users in most cases.