Experimental setup of UFW DDoS protection.

1 min read

An experimental method for setting up DDoS protection using UFW. With the rules provided below, we limit the number of connections to an IP to 20 connections in 10 seconds and the number of packets to 20 packets per second per IP.

nano /etc/ufw/before.rules

Then, add the following lines next to the *filter section at the beginning:

:ufw-http - [0:0]
:ufw-http-logdrop - [0:0]

It should look like this:

EX:
*filter
:ufw-http - [0:0]
:ufw-http-logdrop - [0:0]

:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]

Add these lines before COMMIT:

### start ###
# Enter rule
-A ufw-before-input -p tcp --dport 80 -j ufw-http
-A ufw-before-input -p tcp --dport 443 -j ufw-http

# Limit connections per Class C
-A ufw-http -p tcp --syn -m connlimit --connlimit-above 50 --connlimit-mask 24 -j ufw-http-logdrop

# Limit connections per IP
-A ufw-http -m state --state NEW -m recent --name conn_per_ip --set
-A ufw-http -m state --state NEW -m recent --name conn_per_ip --update --seconds 10 --hitcount 20 -j ufw-http-logdrop

# Limit packets per IP
-A ufw-http -m recent --name pack_per_ip --set
-A ufw-http -m recent --name pack_per_ip --update --seconds 1 --hitcount 20 -j ufw-http-logdrop

# Finally accept
-A ufw-http -j ACCEPT

# Log
-A ufw-http-logdrop -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW HTTP DROP] "
-A ufw-http-logdrop -j DROP
### end ###

Reload the rules

ufw reload

Experimental setup of UFW DDoS protection.

Related articles