nftables DDoS 防护规则生成器

#!/usr/sbin/nft -f
# nftables DDoS 防护规则集 · 由防盾工具箱生成

flush ruleset

table inet ddos_protect {
    set admin_whitelist {
        type ipv4_addr; flags interval;
        elements = { 10.0.0.0/8, 192.168.0.0/16 }
    }

    chain input {
        type filter hook input priority 0; policy drop;

        # 回环与已建立连接
        iif "lo" accept
        ct state established,related accept
        ct state invalid drop

        # 白名单直通
        ip saddr @admin_whitelist accept

        # 异常 TCP 标志组合
        tcp flags & (fin|syn|rst|ack) == 0 drop
        tcp flags & (fin|syn) == (fin|syn) drop
        tcp flags & (syn|rst) == (syn|rst) drop

        # SSH: 单 IP 每分钟最多 6 次新连接 (端口 22)
        tcp dport 22 ct state new limit rate 6/minute burst 12 packets accept

        # Web 端口 (80, 443) : 单 IP 限速 200 包/秒
        tcp dport { 80, 443 } ct state new limit rate over 200/second burst 400 packets drop
        tcp dport { 80, 443 } accept

        # UDP: 丢弃无监听端口的包, 业务端口限速
        udp dport != { 53, 443 } udp length > 0 counter drop
        udp dport { 53, 443 } limit rate over 500/second burst 1000 packets drop
        udp dport { 53, 443 } accept

        # ICMP: 限速放行
        ip protocol icmp limit rate 5/second burst 10 packets accept
        ip protocol icmp drop

        # 记录并丢弃其余流量
        limit rate 5/minute counter log prefix "nft-ddos-drop: " drop
        drop
    }
}

# 应用: nft -f ddos-protect.nft
# 持久化: 复制到 /etc/nftables.conf 并 systemctl enable nftables