Beveiliging tegen DDoS

[Bloom]

Een DDoS of "Distributed Denial of Service" wordt uitgevoerd door een groot team van computers, meestal door malware besmette systemen die dan een botnet genoemd worden.
Die systemen gaan met soms wel miljoenen tegelijk http/https-aanvragen (of van een ander populair protocol) doen bij een server die die toevloed niet meer aankan en ofwel crasht ofwel zo traag wordt als een slak. De dienst stopt dan met toegankelijk zijn en de DDoS is geslaagd.
Nochtans kun je elke Linux server probleemloos beveiligen tegen DDoS door een paar kernelvariabelen goed te zetten.
Zet het onderstaande als 99-antiddos.cnf in /etc/sysctl.d/ in het Linux systeem dat rechtstreeks bereikbaar is via internet.

Code: [Selecteer]

kernel.printk = 4 4 1 7
kernel.panic = 10
kernel.sysrq = 0
kernel.shmmax = 4294967296
kernel.shmall = 4194304
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5
fs.file-max = 2097152
net.core.netdev_max_backlog = 262144
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864
net.core.somaxconn = 65535
net.core.optmem_max = 25165824
net.ipv4.neigh.default.gc_thresh1 = 4096
net.ipv4.neigh.default.gc_thresh2 = 8192
net.ipv4.neigh.default.gc_thresh3 = 16384
net.ipv4.neigh.default.gc_interval = 5
net.ipv4.neigh.default.gc_stale_time = 120
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 20
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.route.flush = 1
net.ipv4.route.max_size = 8048576
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.udp_rmem_min = 16384
net.ipv4.tcp_wmem = 4096 87380 33554432
net.ipv4.udp_wmem_min = 16384
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_orphans = 400000
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 10
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1
En voer het dan uit via als root:

Code: [Selecteer]

sysctl -p /etc/sysctl.d/99-antiddos.cnf
Deze instructies spitsen zich toe op IPv4. Iets soortgelijks kun je ook doen voor IPv6.

[MKe]

Een DDoS of "Distributed Denial of Service" wordt uitgevoerd door een groot team van computers, meestal door malware besmette systemen die dan een botnet genoemd worden.
Die systemen gaan met soms wel miljoenen tegelijk http/https-aanvragen (of van een ander populair protocol) doen bij een server die die toevloed niet meer aankan en ofwel crasht ofwel zo traag wordt als een slak. De dienst stopt dan met toegankelijk zijn en de DDoS is geslaagd.
Nochtans kun je elke Linux server probleemloos beveiligen tegen DDoS door een paar kernelvariabelen goed te zetten.
Zet het onderstaande als 99-antiddos.cnf in /etc/sysctl.d/ in het Linux systeem dat rechtstreeks bereikbaar is via internet.

Code: [Selecteer]

kernel.printk = 4 4 1 7
kernel.panic = 10
kernel.sysrq = 0
kernel.shmmax = 4294967296
kernel.shmall = 4194304
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5
fs.file-max = 2097152
net.core.netdev_max_backlog = 262144
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864
net.core.somaxconn = 65535
net.core.optmem_max = 25165824
net.ipv4.neigh.default.gc_thresh1 = 4096
net.ipv4.neigh.default.gc_thresh2 = 8192
net.ipv4.neigh.default.gc_thresh3 = 16384
net.ipv4.neigh.default.gc_interval = 5
net.ipv4.neigh.default.gc_stale_time = 120
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 20
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.route.flush = 1
net.ipv4.route.max_size = 8048576
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.udp_rmem_min = 16384
net.ipv4.tcp_wmem = 4096 87380 33554432
net.ipv4.udp_wmem_min = 16384
net.ipv4.tcp_max_tw_buckets = 1440000
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_orphans = 400000
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 10
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1
En voer het dan uit via als root:

Code: [Selecteer]

sysctl -p /etc/sysctl.d/99-antiddos.cnf
Deze instructies spitsen zich toe op IPv4. Iets soortgelijks kun je ook doen voor IPv6.

Hoi Bloom, dank hiervoor! Kun je iets meer uitleggen over wat dit doet? Of heb je links naar documentatie?

[Bloom]

Het is een hele grote boterham om dat allemaal te gaan uitleggen en daar heb ik nu geen tijd voor, vrees ik.
Je vindt echter heel veel info over het beveiligen tegen DDoS en andere interneteuvels op deze site:
https://francois.aichelbaum.com/2013/01/04/creation-dune-plateforme-anti-ddos-modulaire.html
Alles is wel in het Frans, maar wellicht kan Google Translate helpen.

[MKe]

Het is een hele grote boterham om dat allemaal te gaan uitleggen en daar heb ik nu geen tijd voor, vrees ik.
Je vindt echter heel veel info over het beveiligen tegen DDoS en andere interneteuvels op deze site:
https://francois.aichelbaum.com/2013/01/04/creation-dune-plateforme-anti-ddos-modulaire.html
Alles is wel in het Frans, maar wellicht kan Google Translate helpen.

Snap ik maar een link om me op weg te helpen is voldoende

[Bloom]

Die heb ik dus gegeven!

[HWE64]

Ik heb dit op een oude test laptop gezet maar weet totaal niet of dit goed is wat in de terminal staat.

Code: [Selecteer]

henk@henk-SATELLITE-C855-22E:~$ sysctl -p /etc/sysctl.d/99-antiddos.cnf
sysctl: permission denied on key "kernel.printk", ignoring
sysctl: permission denied on key "kernel.panic", ignoring
sysctl: permission denied on key "kernel.sysrq", ignoring
sysctl: permission denied on key "kernel.shmmax", ignoring
sysctl: permission denied on key "kernel.shmall", ignoring
sysctl: permission denied on key "kernel.core_uses_pid", ignoring
sysctl: permission denied on key "kernel.msgmnb", ignoring
sysctl: permission denied on key "kernel.msgmax", ignoring
sysctl: permission denied on key "vm.swappiness", ignoring
sysctl: permission denied on key "vm.dirty_ratio", ignoring
sysctl: permission denied on key "vm.dirty_background_ratio", ignoring
sysctl: permission denied on key "fs.file-max", ignoring
sysctl: permission denied on key "net.core.netdev_max_backlog", ignoring
sysctl: permission denied on key "net.core.rmem_default", ignoring
sysctl: permission denied on key "net.core.rmem_max", ignoring
sysctl: permission denied on key "net.core.wmem_default", ignoring
sysctl: permission denied on key "net.core.wmem_max", ignoring
sysctl: permission denied on key "net.core.somaxconn", ignoring
sysctl: permission denied on key "net.core.optmem_max", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh1", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh2", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh3", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_interval", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_stale_time", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_max", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_loose", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_established", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_fin_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_last_ack", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_recv", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_sent", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_time_wait", ignoring
sysctl: permission denied on key "net.ipv4.tcp_slow_start_after_idle", ignoring
sysctl: permission denied on key "net.ipv4.ip_local_port_range", ignoring
sysctl: permission denied on key "net.ipv4.ip_no_pmtu_disc", ignoring
sysctl: permission denied on key "net.ipv4.route.flush", ignoring
sysctl: permission denied on key "net.ipv4.route.max_size", ignoring
sysctl: permission denied on key "net.ipv4.icmp_echo_ignore_broadcasts", ignoring
sysctl: permission denied on key "net.ipv4.icmp_ignore_bogus_error_responses", ignoring
sysctl: permission denied on key "net.ipv4.tcp_congestion_control", ignoring
sysctl: permission denied on key "net.ipv4.tcp_mem", ignoring
sysctl: permission denied on key "net.ipv4.udp_mem", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_rmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_wmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_wmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_tw_buckets", ignoring
sysctl: cannot stat /proc/sys/net/ipv4/tcp_tw_recycle: Bestand of map bestaat niet
sysctl: permission denied on key "net.ipv4.tcp_tw_reuse", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_orphans", ignoring
sysctl: permission denied on key "net.ipv4.tcp_window_scaling", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rfc1337", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syncookies", ignoring
sysctl: permission denied on key "net.ipv4.tcp_synack_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syn_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_syn_backlog", ignoring
sysctl: permission denied on key "net.ipv4.tcp_timestamps", ignoring
sysctl: permission denied on key "net.ipv4.tcp_sack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_ecn", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fin_timeout", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_time", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_intvl", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_probes", ignoring
sysctl: permission denied on key "net.ipv4.tcp_no_metrics_save", ignoring
sysctl: permission denied on key "net.ipv4.ip_forward", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.send_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_source_route", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.rp_filter", ignoring
henk@henk-SATELLITE-C855-22E:~$
kan iemand mij een tip geven?

[MKe]

Die heb ik dus gegeven!

inderdaad, mijn dank dus.

[Bloom]

Ik heb dit op een oude test laptop gezet maar weet totaal niet of dit goed is wat in de terminal staat.

Code: [Selecteer]

henk@henk-SATELLITE-C855-22E:~$ sysctl -p /etc/sysctl.d/99-antiddos.cnf
sysctl: permission denied on key "kernel.printk", ignoring
sysctl: permission denied on key "kernel.panic", ignoring
sysctl: permission denied on key "kernel.sysrq", ignoring
sysctl: permission denied on key "kernel.shmmax", ignoring
sysctl: permission denied on key "kernel.shmall", ignoring
sysctl: permission denied on key "kernel.core_uses_pid", ignoring
sysctl: permission denied on key "kernel.msgmnb", ignoring
sysctl: permission denied on key "kernel.msgmax", ignoring
sysctl: permission denied on key "vm.swappiness", ignoring
sysctl: permission denied on key "vm.dirty_ratio", ignoring
sysctl: permission denied on key "vm.dirty_background_ratio", ignoring
sysctl: permission denied on key "fs.file-max", ignoring
sysctl: permission denied on key "net.core.netdev_max_backlog", ignoring
sysctl: permission denied on key "net.core.rmem_default", ignoring
sysctl: permission denied on key "net.core.rmem_max", ignoring
sysctl: permission denied on key "net.core.wmem_default", ignoring
sysctl: permission denied on key "net.core.wmem_max", ignoring
sysctl: permission denied on key "net.core.somaxconn", ignoring
sysctl: permission denied on key "net.core.optmem_max", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh1", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh2", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_thresh3", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_interval", ignoring
sysctl: permission denied on key "net.ipv4.neigh.default.gc_stale_time", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_max", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_loose", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_established", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_close_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_fin_wait", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_last_ack", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_recv", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_syn_sent", ignoring
sysctl: permission denied on key "net.netfilter.nf_conntrack_tcp_timeout_time_wait", ignoring
sysctl: permission denied on key "net.ipv4.tcp_slow_start_after_idle", ignoring
sysctl: permission denied on key "net.ipv4.ip_local_port_range", ignoring
sysctl: permission denied on key "net.ipv4.ip_no_pmtu_disc", ignoring
sysctl: permission denied on key "net.ipv4.route.flush", ignoring
sysctl: permission denied on key "net.ipv4.route.max_size", ignoring
sysctl: permission denied on key "net.ipv4.icmp_echo_ignore_broadcasts", ignoring
sysctl: permission denied on key "net.ipv4.icmp_ignore_bogus_error_responses", ignoring
sysctl: permission denied on key "net.ipv4.tcp_congestion_control", ignoring
sysctl: permission denied on key "net.ipv4.tcp_mem", ignoring
sysctl: permission denied on key "net.ipv4.udp_mem", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_rmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_wmem", ignoring
sysctl: permission denied on key "net.ipv4.udp_wmem_min", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_tw_buckets", ignoring
sysctl: cannot stat /proc/sys/net/ipv4/tcp_tw_recycle: Bestand of map bestaat niet
sysctl: permission denied on key "net.ipv4.tcp_tw_reuse", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_orphans", ignoring
sysctl: permission denied on key "net.ipv4.tcp_window_scaling", ignoring
sysctl: permission denied on key "net.ipv4.tcp_rfc1337", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syncookies", ignoring
sysctl: permission denied on key "net.ipv4.tcp_synack_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_syn_retries", ignoring
sysctl: permission denied on key "net.ipv4.tcp_max_syn_backlog", ignoring
sysctl: permission denied on key "net.ipv4.tcp_timestamps", ignoring
sysctl: permission denied on key "net.ipv4.tcp_sack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fack", ignoring
sysctl: permission denied on key "net.ipv4.tcp_ecn", ignoring
sysctl: permission denied on key "net.ipv4.tcp_fin_timeout", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_time", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_intvl", ignoring
sysctl: permission denied on key "net.ipv4.tcp_keepalive_probes", ignoring
sysctl: permission denied on key "net.ipv4.tcp_no_metrics_save", ignoring
sysctl: permission denied on key "net.ipv4.ip_forward", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.send_redirects", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.accept_source_route", ignoring
sysctl: permission denied on key "net.ipv4.conf.all.rp_filter", ignoring
henk@henk-SATELLITE-C855-22E:~$
kan iemand mij een tip geven?

Zoals ik schreef moet je dat als ROOT uitvoeren, dus met sudo ervoor!

[HWE64]

@Bloom bedankt. Dus deze pc met deze distriibutie kan niet gebruikt worden voor een DDos aanval.

Code: [Selecteer]

henk@henk-SATELLITE-C855-22E:~$ sudo sysctl -p /etc/sysctl.d/99-antiddos.cnf
[sudo] wachtwoord voor henk:     
kernel.printk = 4 4 1 7
kernel.panic = 10
kernel.sysrq = 0
kernel.shmmax = 4294967296
kernel.shmall = 4194304
kernel.core_uses_pid = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
vm.swappiness = 20
vm.dirty_ratio = 80
vm.dirty_background_ratio = 5
fs.file-max = 2097152
net.core.netdev_max_backlog = 262144
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864
net.core.somaxconn = 65535
net.core.optmem_max = 25165824
net.ipv4.neigh.default.gc_thresh1 = 4096
net.ipv4.neigh.default.gc_thresh2 = 8192
net.ipv4.neigh.default.gc_thresh3 = 16384
net.ipv4.neigh.default.gc_interval = 5
net.ipv4.neigh.default.gc_stale_time = 120
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0
net.netfilter.nf_conntrack_tcp_timeout_established = 1800
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_last_ack = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 20
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 20
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.ip_no_pmtu_disc = 1
net.ipv4.route.flush = 1
net.ipv4.route.max_size = 8048576
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_mem = 65536 131072 262144
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.udp_rmem_min = 16384
net.ipv4.tcp_wmem = 4096 87380 33554432
net.ipv4.udp_wmem_min = 16384
net.ipv4.tcp_max_tw_buckets = 1440000
sysctl: cannot stat /proc/sys/net/ipv4/tcp_tw_recycle: Bestand of map bestaat niet
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_max_orphans = 400000
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_max_syn_backlog = 16384
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 10
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1
henk@henk-SATELLITE-C855-22E:~$


[Bloom]

Een pc hang je doorgaans niet met een publiek ip-adres op het internet, dus voor een gewone desktoppc is dat zinloos.
Maar een Linux server of UTM of firewall die wél rechtstreeks aan internet hangt met een publiek ip-adres, zou zoiets moeten doen.

[HWE64]

Een pc hang je doorgaans niet met een publiek ip-adres op het internet, dus voor een gewone desktoppc is dat zinloos.
Maar een Linux server of UTM of firewall die wél rechtstreeks aan internet hangt met een publiek ip-adres, zou zoiets moeten doen.

Excuus voor mijn onkunde :'(

[Spidey-Westland]

Moet dit helemaal onderin /etc/sysctl.d/  toegevoegd worden?

mvg SPW

[Bloom]

Dat is een directory, dus bestanden daarin staan standaard alfabetisch/numeriek gesorteerd. Een bestand dat met 99 begint zal als laatste uitgevoerd worden. Dat zorgt ervoor dat als je voor DDoS instellingen nodig hebt die eerdere instellingen of configuraties anders ingesteld hadden, dat die dan overschreven worden.