Panduan Lengkap Anti-DDoS: Installasi Iptables, Hardening, dan Cloudflare Proxy

apt update
apt install -y iptables iptables-persistent

yum install -y iptables iptables-services
systemctl enable iptables
systemctl start iptables

iptables --version

#!/bin/sh
### FINAL FIREWALL RULES (Extreme Stealth Mode) ###

# Flush rules lama dulu (bersih total)
iptables -F
iptables -X

# Default policy DROP (semua ditolak kalau tidak di-whitelist)
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# 0. Drop semua ICMP (ping, traceroute, dll)
iptables -I INPUT -p icmp -j DROP

# 1. Allow loopback & established
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# 2. Allow SSH hanya dari IP kamu
iptables -A INPUT -p tcp -s 103.160.62.98 --dport 34789 -m state --state NEW -j ACCEPT

# 3. Allow Web dari Cloudflare IPv4 (HTTP/HTTPS)
for cfip in \
103.21.244.0/22 \
103.22.200.0/22 \
103.31.4.0/22 \
104.16.0.0/13 \
104.24.0.0/14 \
108.162.192.0/18 \
131.0.72.0/22 \
141.101.64.0/18 \
162.158.0.0/15 \
172.64.0.0/13 \
173.245.48.0/20 \
188.114.96.0/20 \
190.93.240.0/20 \
197.234.240.0/22 \
198.41.128.0/17
do
  iptables -A INPUT -p tcp -s $cfip --dport 80 -m state --state NEW -j ACCEPT
  iptables -A INPUT -p tcp -s $cfip --dport 443 -m state --state NEW -j ACCEPT
done

# 4. Drop semua akses lain ke Web & SSH (kalau ada yg nekat direct IP asli)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 34789 -j DROP

# 5. Limit new TCP connection (anti SYN flood basic)
iptables -A INPUT -p tcp --syn -m limit --limit 30/second --limit-burst 100 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

# 6. Save rules supaya auto-load saat reboot
iptables-save > /etc/iptables/rules.v4

# ==============================
# Anti-DDoS & Networking Hardening
# ==============================

# ==============================
# TCP / Connection Handling
# ==============================
# Enable SYN cookies (lindungi dari SYN flood)
net.ipv4.tcp_syncookies = 1

# Maksimal backlog koneksi setengah terbuka (SYN_RECV)
net.ipv4.tcp_max_syn_backlog = 8192

# Maksimal koneksi yang belum dikonfirmasi per source
net.ipv4.tcp_max_orphans = 32768

# Drop koneksi invalid lebih cepat
net.netfilter.nf_conntrack_tcp_loose = 0

# Waktu koneksi TCP dalam state TIME_WAIT (lebih pendek = hemat memory)
net.ipv4.tcp_fin_timeout = 15

# Aktifkan reuse TIME_WAIT (kurangi koneksi menumpuk)
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0   # jangan aktif, sering bikin masalah NAT

# Maksimal koneksi yang ditrack (sesuaikan RAM besar)
net.netfilter.nf_conntrack_max = 524288
net.netfilter.nf_conntrack_buckets = 131072

# ==============================
# ICMP & IP Spoof Protection
# ==============================
# Jangan terima ICMP redirect (hindari spoof)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Jangan terima source routing
net.ipv4.conf.all.accept_source_route = 0

# Aktifkan reverse path filtering (hindari spoof IP)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Batasi ICMP echo (ping flood)
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ratelimit = 1000
net.ipv4.icmp_ratemask = 88089

# ==============================
# Socket / Queue Tuning
# ==============================
# Maksimal file descriptor (karena RAM besar)
fs.file-max = 2097152

# Queue socket lebih besar (32 core server kuat handle)
net.core.somaxconn = 8192
net.core.netdev_max_backlog = 65536

# ==============================
# TCP Buffer & Performance
# ==============================
# Buffer TCP lebih besar (buat high traffic)
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.tcp_wmem = 4096 65536 33554432
net.core.rmem_max = 33554432
net.core.wmem_max = 33554432

# Allow auto-tuning TCP Window Scaling (penting buat bandwidth gede)
net.ipv4.tcp_window_scaling = 1

# ==============================
# Extra Defense
# ==============================
# Drop invalid packets lebih cepat
net.netfilter.nf_conntrack_tcp_timeout_close = 10
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 20
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30

# Kurangi efek "RST flood"
net.ipv4.tcp_rfc1337 = 1

# Aktifkan fast recycling TIME_WAIT untuk koneksi dari client unik
net.ipv4.tcp_tw_reuse = 1

sysctl --system