Minecraft Anti-DDoS iptables configuration

iptables

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A PREROUTING -p tcp -m tcp --dport 25565 -j CT --notrack
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:WHITELIST - [0:0]
:SYN_FLOOD - [0:0]

# Drop invalid packets
-A PREROUTING -m conntrack --ctstate INVALID -j DROP

# Drop TCP packets that are new and are not SYN
-A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

# Block packets with bogus TCP flags
-A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
-A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
-A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
-A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
-A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
-A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
-A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
-A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

# Block spoofed packets
-A PREROUTING -s 224.0.0.0/3 -j DROP
-A PREROUTING -s 169.254.0.0/16 -j DROP
-A PREROUTING -s 172.16.0.0/12 -j DROP
-A PREROUTING -s 192.0.2.0/24 -j DROP
-A PREROUTING -s 192.168.0.0/16 -j DROP
-A PREROUTING -s 10.0.0.0/8 -j DROP
-A PREROUTING -s 0.0.0.0/8 -j DROP
-A PREROUTING -s 240.0.0.0/5 -j DROP
-A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP

# Drop ICMP packets
-A PREROUTING -p icmp -j DROP

# Drop fragments in all chains
-A PREROUTING -f -j DROP

# Drop unwanted packets
-A PREROUTING -p tcp -j WHITELIST
-A WHITELIST -i lo -j RETURN
-A WHITELIST -p tcp -m tcp --dport 22 -j RETURN
-A WHITELIST -p tcp -m tcp --dport 80 -j RETURN
-A WHITELIST -p tcp -m tcp --dport 443 -j RETURN
-A WHITELIST -p tcp -m tcp --dport 25565 -j RETURN
-A WHITELIST -p tcp -m tcp --sport 25565 -j RETURN
-A WHITELIST -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j RETURN
-A WHITELIST -j DROP

# Drop SYN flood packets
-A PREROUTING -p tcp --syn -j SYN_FLOOD
-A SYN_FLOOD -m limit --limit 10000/s --limit-burst 10000 -j RETURN
-A SYN_FLOOD -j DROP
COMMIT

thanks <3