Ограничения входящего трафика CentOS

-A INPUT -p udp --dport 444 -m hashlimit --hashlimit 1/s --hashlimit-burst 5 --hashlimit-mode srcip,srcport --hashlimit-name TEST -j ACCEPT
-A INPUT -p udp --dport 444 -j DROP

-A INPUT -p udp --dport 444 -m connlimit --connlimit-above 10 -j DROP

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 444 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
-A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
-A INPUT -p udp --dport 444 -m connlimit --connlimit-above 10 -j DROP
COMMIT

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Начало фильтра
# Создаем цепочки POP3 attack
-N POP3_CHECK
-N POP3_ATTACKED
# Захватываем POP3-соединение
-A INPUT -p udp --dport 444 -j POP3_CHECK
# Определяем цепочку POP3_CHECK
-A POP3_CHECK -m recent --set --name POP3
-A POP3_CHECK -m recent --update --seconds 10 --hitcount 2 --name POP3 -j POP3_ATTACKED
-A POP3_CHECK -j ACCEPT
# Определяем цепочку POP3_ATTACKED
-A POP3_ATTACKED -j LOG --log-prefix "iptables POP3 attack: "
-A POP3_ATTACKED -j REJECT --reject-with icmp-host-unreachable
# Конец фильтра


-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
COMMIT