Ubuntu Tomcat 防 DDoS 实用方案
一 分层防护思路
二 关键配置示例
Tomcat 连接器收紧(server.xml)
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="2000"
maxThreads="200"
minSpareThreads="25"
maxSpareThreads="75"
acceptCount="100"
redirectPort="8443"
enableLookups="false"
maxHttpHeaderSize="8192"
URIEncoding="UTF-8" />
系统与防火墙(UFW + iptables)
sudo ufw allow from 203.0.113.0/24 to any port 8080,8443 proto tcp
sudo ufw enable
sudo iptables -A INPUT -p tcp --syn --dport 80,443 -m connlimit --connlimit-above 20 -j REJECT --reject-with tcp-reset
内核参数(抵御 SYN Flood)
sudo sysctl -w net.ipv4.tcp_syncookies=1
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=1280
sudo sysctl -w net.ipv4.tcp_synack_retries=2
sudo sysctl -w net.ipv4.tcp_syn_retries=2
反向代理与 WAF(Nginx 示例)
http {
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=perip:10m;
server {
listen 80;
server_name your.domain;
location / {
limit_req zone=api burst=20 nodelay;
limit_conn perip 20;
client_max_body_size 10m;
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# 可选:启用 ModSecurity/WAF
# modsecurity on;
# modsecurity_rules_file /etc/nginx/modsec/main.conf;
}
}
三 检测与应急
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head
ss -s
sudo tcpdump -s0 -A -n -i any | grep -o -E '(GET|POST|HEAD) .*'
四 安全加固与运维要点
五 何时引入专业防护