Iptables Anti DDos config

# AntiPort scan
-A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j DROP
-A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j DROP
# Denie 2 second recent create 6 new connect per ip
 -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -m recent --update --seconds 2 --hitcount 6 --name DEFAULT --rsource -j DROP
-A INPUT -p tcp --dport 80 -m limit --limit 3/sec --limit-burst 10 -j DROP
-A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 15 -j DROP
-A INPUT -p tcp -m string --string "string you want to block" --algo bm -j DROP
-A INPUT -p tcp -m string --string "string you want to block" --algo kmp -j DROP
-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s "your IP" -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP
-A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
-A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j DROP
-A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
-A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
-A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
-A INPUT -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A OUTPUT -m state --state INVALID -j DROP
-A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
-A INPUT -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
-A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
-A INPUT -p tcp --tcp-flags RST RST -j DROP
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP
#-A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH SYN -j DROP
-A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH FIN -j DROP
-A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH ACK -j DROP
-A INPUT -m conntrack --ctstate INVALID -p tcp --tcp-flags ! SYN,RST,ACK,FIN,URG,PSH SYN,RST,ACK,FIN,URG,PSH -j DROP
-A INPUT -m conntrack --ctstate NEW -p tcp --tcp-flags SYN,RST,ACK,FIN,URG,PSH FIN,URG,PSH -j DROP
# Now allow for HTTP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p tcp --syn -j DROP
-A INPUT -j REJECT
-A FORWARD -j REJECT