tcpguarder

Inspiration from https://github.com/jagerzhang/CCKiller

go get github.com/lixiangzhong/tcpguarder/cmd/tcpguarder

[root@localhost ~]# tcpguarder -h
NAME:
   tcpguarder - tcpguarder

USAGE:
   tcpguarder [global options] command [command options] [arguments...]

COMMANDS:
   run       block ip auto
   china     create china ipset
   notchina  create not-china ipset
   help, h   Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --ipset value                            ipset name (default: "blackhold")
   --port value, -p value                   local ports, default all ports,example: -port 80 -port 443
   --timeout value, -t value, --time value  ipset timeout second (default: 600)
   --top n                                  show top list n (default: 10)
   --white FILE, -w FILE                    load white ip from FILE (default: "whiteip.txt")
   --help, -h                               show help (default: false)

# Display by highest IP connection number

[root@localhost ~]# tcpguarder
127.0.0.1	5
10.10.0.1	2

total
ip: 2 tcp: 7

# Automatically block IPs with connections greater than 200
# Program will block forever

[root@localhost ~]# tcpguarder run -k=200
please confirm the following iptable is in effect
iptables -I INPUT -p tcp -m set --match-set blackhold src -j DROP
load white ip file: whiteip.txt
2020/03/20 17:51:26 open whiteip.txt: no such file or directory
white ip num: 0
local ip: 127.0.0.1
local ip: 10.10.1.244
white ip num: 2
every 3s kill if conn/ip >= 200

# Count every 10 seconds, and block IPs with connections greater than 200

[root@localhost ~]# ./tcpguarder run -k=200 -every=10s

# Statistics every 3 seconds to connect to ports 80 and 443, and block IPs with more than 100 links
# 每3秒统计连接到80和443端口,并且屏蔽链接数大于100的IP

[root@localhost ~]# ./tcpguarder run -k=100 -port 80 -port 443

# Create an ipset without a Chinese IP

[root@localhost ~]# tcpguarder notchina
please confirm the following iptable is in effect
iptables -I INPUT -p tcp -m set --match-set notchina src -j DROP
iptables -I INPUT -p tcp -m set --match-set notchina src -m multiport --dports 80,443 -j DROP

# Create an ipset containing only Mainland China IP

[root@localhost ~]# tcpguarder china
please confirm the following iptable is in effect
iptables -I INPUT -p tcp -m set --match-set china src -j DROP
iptables -I INPUT -p tcp -m set --match-set china src -m multiport --dports 80,443 -j DROP