#!/bin/bash
# Comprehensive iptables DDoS protection rules

# Drop invalid packets
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

# Drop TCP packets without SYN
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

# Drop SYN packets with suspicious MSS
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

# Block packets with bogus TCP flags
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# Rate limit new TCP connections
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP

# Limit connections per source IP
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

# UDP flood protection
iptables -A INPUT -p udp -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p udp -j DROP

# ICMP flood protection
iptables -A INPUT -p icmp -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp -j DROP

# /etc/sysctl.conf DDoS protection settings

# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Reduce TIME_WAIT sockets
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_tw_reuse = 1

# Increase netdev budget for high packet rates
net.core.netdev_budget = 600
net.core.netdev_max_backlog = 5000

# TCP buffer tuning
net.core.rmem_default = 262144
net.core.rmem_max = 16777216
net.core.wmem_default = 262144
net.core.wmem_max = 16777216

# Ignore ICMP redirects and source routing
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0

# Enable reverse path filtering
net.ipv4.conf.all.rp_filter = 1

# /etc/nginx/nginx.conf
http {
    # Define rate limiting zones
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=general:10m rate=5r/s;

    # Connection limiting
    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
    limit_conn_zone $server_name zone=conn_limit_per_server:10m;

    # Request size limits
    client_max_body_size 10M;
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;

    server {
        # Apply rate limits
        limit_req zone=general burst=10 nodelay;
        limit_conn conn_limit_per_ip 10;
        limit_conn conn_limit_per_server 100;

        # Timeout settings
        client_body_timeout 10s;
        client_header_timeout 10s;
        keepalive_timeout 5s 5s;
        send_timeout 10s;

        # Block suspicious patterns
        location ~* \.(sql|bak|inc|old|tmp)$ {
            deny all;
        }

        # API endpoint protection
        location /api/ {
            limit_req zone=api burst=20 nodelay;
            limit_req_status 429;
        }

        # Login endpoint protection
        location /login {
            limit_req zone=login burst=5 nodelay;
            limit_req_status 429;
        }
    }
}

# Custom ModSecurity rules for DDoS protection
SecRule REQUEST_METHOD "@streq POST" \
    "id:1001,phase:2,t:none,block,msg:'POST Flood Attack',logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    setvar:'ip.post_counter=+1',expirevar:'ip.post_counter=60',\
    setvar:'ip.post_block=1',expirevar:'ip.post_block=300"

SecRule IP:POST_COUNTER "@gt 10" \
    "id:1002,phase:2,t:none,deny,status:429,\
    msg:'Client IP blocked for 5 minutes due to POST flooding',\
    setvar:'ip.post_block=1',expirevar:'ip.post_block=300"

# Slow attack protection
SecRule REQUEST_HEADERS:Content-Length "@gt 1048576" \
    "id:1003,phase:1,t:none,deny,status:413,\
    msg:'Request body too large - potential slow POST attack'"

// Cloudflare Workers script for advanced DDoS protection
addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const ip = request.headers.get('CF-Connecting-IP')
  const country = request.headers.get('CF-IPCountry')
  const userAgent = request.headers.get('User-Agent')

  // Block requests from high-risk countries
  const blockedCountries = ['CN', 'RU', 'KP']
  if (blockedCountries.includes(country)) {
    return new Response('Access denied', { status: 403 })
  }

  // Block requests without User-Agent
  if (!userAgent || userAgent.length < 10) {
    return new Response('Bad request', { status: 400 })
  }

  // Rate limiting logic
  const rateLimitKey = `rate_limit:${ip}`
  const currentCount = await RATE_LIMIT.get(rateLimitKey)

  if (currentCount && parseInt(currentCount) > 100) {
    return new Response('Rate limit exceeded', { status: 429 })
  }

  // Increment counter
  await RATE_LIMIT.put(rateLimitKey, (parseInt(currentCount) || 0) + 1, {
    expirationTtl: 60
  })

  return fetch(request)
}

# CloudFormation template for AWS Shield Advanced
Resources:
  DDoSProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: WebApplicationProtection
      ResourceArn: !GetAtt ApplicationLoadBalancer.LoadBalancerArn

  DDoSResponseTeam:
    Type: AWS::Shield::DRTAccess
    Properties:
      RoleArn: !GetAtt ShieldDRTRole.Arn
      LogBucketList:
        - !Ref DDoSLogBucket

  WAFWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules:
        - Name: RateLimitRule
          Priority: 1
          Statement:
            RateBasedStatement:
              Limit: 2000
              AggregateKeyType: IP
          Action:
            Block: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitRule

# prometheus.yml configuration for DDoS monitoring
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'nginx-exporter'
    static_configs:
      - targets: ['localhost:9113']

  - job_name: 'node-exporter'
    static_configs:
      - targets: ['localhost:9100']

rule_files:
  - "ddos_rules.yml"

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

# ddos_rules.yml
groups:
- name: ddos_protection
  rules:
  - alert: HighRequestRate
    expr: rate(nginx_http_requests_total[1m]) > 100
    for: 2m
    labels:
      severity: warning
    annotations:
      summary: "High request rate detected"

  - alert: DDoSAttackDetected
    expr: rate(nginx_http_requests_total[1m]) > 1000
    for: 30s
    labels:
      severity: critical
    annotations:
      summary: "Potential DDoS attack in progress"