Linux高可用DDoS防御配置方案

一、基础系统加固

1. 内核参数优化 (/etc/sysctl.conf):

# 防止SYN洪水攻击
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# 限制ICMP请求
net.ipv4.icmp_echo_ignore_all = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 其他安全参数
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

2. 应用更改:

sysctl -p

二、网络层防御

1. iptables/nftables配置:

# 创建专用链
iptables -N ANTI_DDOS

# 限制连接速率
iptables -A ANTI_DDOS -p tcp --dport 80 -m connlimit --connlimit-above 50 -j DROP
iptables -A ANTI_DDOS -p tcp --dport 443 -m connlimit --connlimit-above 50 -j DROP

# 限制新连接速率
iptables -A ANTI_DDOS -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A ANTI_DDOS -p tcp --syn -j DROP

# 应用链到INPUT
iptables -I INPUT -j ANTI_DDOS

2. nftables等效配置:

nft add table ip filter
nft add chain ip filter ANTI_DDOS
nft add rule ip filter ANTI_DDOS tcp dport 80 ct count over 50 drop
nft add rule ip filter ANTI_DDOS tcp dport 443 ct count over 50 drop
nft add rule ip filter ANTI_DDOS tcp flags syn limit rate 1/second burst 3 packets return
nft add rule ip filter ANTI_DDOS tcp flags syn drop
nft add rule ip filter input jump ANTI_DDOS

三、应用层防御

1. Fail2Ban安装配置:

apt install fail2ban  # Debian/Ubuntu
yum install fail2ban  # RHEL/CentOS

2. 自定义jail配置 (/etc/fail2ban/jail.local):

[sshd]
enabled = true
maxretry = 3
bantime = 1h

[nginx-http-auth]
enabled = true
filter = nginx-http-auth
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 3
bantime = 1h

四、专业DDoS防护工具

1. 安装和配置ModSecurity + OWASP CRS:

# 对于Nginx
apt install libmodsecurity3 modsecurity-crs  # Debian/Ubuntu

# 配置OWASP核心规则集
cp -r /usr/share/modsecurity-crs/ /etc/nginx/modsec/
mv /etc/nginx/modsec/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf

2. 安装配置Nginx限速模块:

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

    server {
        location / {
            limit_req zone=one burst=20 nodelay;
        }
    }
}

五、高可用架构设计

1. 负载均衡配置 (以Nginx为例):

upstream backend {
    server backend1.example.com;
    server backend2.example.com;
    server backend3.example.com;

    # 健康检查
    check interval=3000 rise=2 fall=5 timeout=1000;
}

server {
    listen 80;
    location / {
        proxy_pass http://backend;
    }
}

2. 云服务集成:

- 配置AWS Shield/Azure DDoS Protection/Google Cloud Armor - 启用CDN服务(Cloudflare, Akamai等)

六、监控与响应

1. 安装配置监控工具:

# NetData实时监控
bash <(curl -Ss https://my-netdata.io/kickstart.sh)

# vnStat带宽监控
apt install vnstat
vnstat -l -i eth0  # 实时监控

2. 自定义告警脚本:

#!/bin/bash
THRESHOLD=1000  # 1000 packets/sec
INTERFACE=eth0

while true; do
    CURRENT=$(grep $INTERFACE /proc/net/dev | awk '{print $2}')
    sleep 1
    NEXT=$(grep $INTERFACE /proc/net/dev | awk '{print $2}')
    TRAFFIC=$((NEXT - CURRENT))

    if [ $TRAFFIC -gt $THRESHOLD ]; then
        echo "DDoS可能攻击检测到! 流量: $TRAFFIC pps" | mail -s "DDoS警报" admin@example.com
        # 触发自动防御措施
        iptables -A INPUT -p tcp --dport 80 -j DROP
    fi
done

七、应急响应计划

1. 预先准备的应急措施:

- 与ISP建立联系，了解他们的DDoS缓解服务 - 准备备用IP切换方案 - 建立服务降级预案

2. 攻击发生时的检查清单:

# 快速识别攻击
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

# 检查连接状态
ss -s

# 查看实时流量
iftop -i eth0

通过以上多层防御策略的组合，可以构建一个相对完善的DDoS防护体系。实际部署时应根据具体业务需求进行调整，并定期进行压力测试验证防御效果。