ЗАЩИТА ОТ СКАНИРОВАНИЯ

-A INPUT -m recent —rcheck —seconds 86400 —name portscan —mask 255.255.255.255 —rsource -j portscan
-A INPUT -m recent —rcheck —seconds 86400 —name UDP_FLOOD —mask 255.255.255.255 —rsource -j portscan
-A INPUT -m recent —remove —name portscan —mask 255.255.255.255 —rsource
-A INPUT -m recent —remove —name UDP_FLOOD —mask 255.255.255.255 —rsource
-A INPUT -p tcp -m tcp -m recent —set —name portscan —mask 255.255.255.255 —rsource -m state —state NEW -j portscan
-A INPUT -p udp -m state —state NEW -m recent —set —name Domainscans —mask 255.255.255.255 —rsource
-A INPUT -p udp -m state —state NEW -m recent —rcheck —seconds 5 —hitcount 5 —name Domainscans —mask 255.255.255.255 —rsource -j UDP
-A INPUT -p udp -m string —hex-string «|0000ff0001|» —algo bm —to 65535 -j domainscan
-A INPUT -p udp -m udp —dport 53 -m state —state NEW -m recent —set —name Domainscans —mask 255.255.255.255 —rsource -j ACCEPT
-A INPUT -p udp -m state —state NEW -m recent —update —seconds 1 —hitcount 10 —name Domainscans —mask 255.255.255.255 —rsource -j domainscan
-A UDP -j LOG —log-prefix «UDP_FLOOD »
-A UDP -p udp -m state —state NEW -m recent —set —name UDP_FLOOD —mask 255.255.255.255 —rsource
-A UDP -j DROP
-A domainscan -j LOG —log-prefix «Blocked_domain_scans »
-A domainscan -p tcp -m state —state NEW -m recent —set —name Webscanners —mask 255.255.255.255 —rsource
-A domainscan -j DROP
-A portscan -j LOG —log-prefix «Blocked_scans »
-A portscan -j DROP