Made By RebornXV TCP PatchV2 Update
-
# Set default policies to DROP all incoming traffic
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
-
# Allow incoming traffic to the VPN port (adjust as per your VPN)
# Example: OpenVPN usually uses UDP port 1194
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
-
# Allow incoming traffic from established/related connections (important for reply packets)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-
# Limit the rate of incoming UDP packets (example: 10 packets per second with burst of 20)
iptables -A INPUT -p udp --dport 1194 -m limit --limit 10/s --limit-burst 20 -j ACCEPT
-
# Limit the number of new incoming TCP connections per second (e.g., 1 connection per second)
iptables -A INPUT -p tcp --dport 1194 -m connlimit --connlimit-above 100 --connlimit-mask 32 -j REJECT
-
# Limit incoming TCP connection attempts to 1 per second per IP (to prevent brute force)
iptables -A INPUT -p tcp --dport 1194 -m recent --name ssh --set
iptables -A INPUT -p tcp --dport 1194 -m recent --name ssh --update --seconds 1 --hitcount 4 -j DROP
-
# Limit the rate of new TCP connections (SYN packets) to prevent SYN flood attacks
iptables -A INPUT -p tcp --syn --dport 1194 -m limit --limit 1/s --limit-burst 4 -j ACCEPT
-
# Drop packets with invalid states (such as not belonging to any existing connection)
iptables -A INPUT -m state --state INVALID -j DROP
-
# Drop traffic from specific IP addresses (replace 1.2.3.4 with the malicious IP)
iptables -A INPUT -s 1.2.3.4 -j DROP
-
# Limit ICMP requests (e.g., 1 per second)
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 4 -j ACCEPT
-
# Allow already established connections and related packets
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-
# Log packets that are dropped
iptables -A INPUT -j LOG --log-prefix "iptables: "
-
# Track the source IP and check for flood conditions
iptables -A INPUT -p tcp --dport 1194 -m recent --name vpn_flood --update --seconds 60 --hitcount 20 -j DROP
iptables -A INPUT -p tcp --dport 1194 -m recent --name vpn_flood --set -j ACCEPT
-
this works with royale hosting tcp update for paths an royale hosting