Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

what is a good public available iptables script for ddos mitigation?

share|improve this question

Have a look at the questions on:

as the answers there will give some indication. Basically you can't do it in a device as the distributed nature of the attack means you need to have infrastructure which can cope, which is why DDoS protection services tend to be provided in conjunction with ISPs and depend more on active routing, path restrictions and upstream filtering.

share|improve this answer

Sorry, but you cannot effectively guard against modern DDoS attacks with a software firewall running directly on the server. The packet rates can get way too high and/or the packets come in on a valid port which your firewall permits through.

You can do basic rate limiting with iptables. But the first "d" in DDoS stands for "distributed". There are many hosts participating in the attack, and each host may contribute at a low rate, so rate-limiting may not help that much.

That said, if you want a management tool for iptables there are several options. Ubuntu ships with "ufw" -- uncomplicated firewall, and it lives up to its name. For slightly more complex solutions, I like Shorewall a lot. There are many others -- go to the support forums of your favorite distro, and you will find plenty of options.

share|improve this answer
the iptable maybe is not running locally in his server. maybe its a gateway, or even a router running Zebra or Quagga. – VP. May 6 '11 at 21:42
@VP01: Yes, you're quite right. It's hard to say precisely, since the original question is light on specific information, but in the majority of cases were iptables is run on a single gateway/linux router, it will be of little use against well-executed DDoS attacks. The packet rates overwhelm all on-the-server solutions. This answer describes what good DDoS protection looks like (it need to be done 'upstream' of the servers):… – Jesper Mortensen May 7 '11 at 7:09
yes, upstream is the right place to do. But from his question we cannot assume that he is an end-user. Maybe he is a netadmin, under attack from a small ISP without no clue :-) – VP. May 7 '11 at 7:32

It's not iptables, but I like Roboo.

share|improve this answer

[Quot: Sorry, but you cannot effectively guard against modern DDoS attacks with a software firewall running directly on the server]

100% correct. Deflation and Load-Balancing are the only 100% full-proof DDoS mitigation measures. Of course you`ll need a multi-server setup or Cloud CDN for that. (For more info. check out this comparison review of Cloud security service providers)

Also I must say that limiting IP ranges is not only ineffective but also (potentially) damaging. As mentioned, DDoS uses botnet - a network of PCs that can sometimes be a very large pool of an inconsistent IPs.

In this more and more commonly occurring scenario, blocking an "attacking" IP range can actually prevent access from legitimate visitors, while not preventing DDoS attack itself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.