0

My server occasionally get massively hit by (probably bots) on a small group of IPs. Is there a good way (probably in iptables) to slow down or temporarily block/tarpit connections coming from an IP that has connected many times recently?

Improve this question

2 Answers 2

Reset to default
0

Yes, iptables supports this kind of dynamic rate limiting.

See here for details: http://codingfreak.blogspot.com/2010/01/iptables-rate-limit-incoming.html

Improve this answer
1
  • Hmm... it seems that I cannot set a --hitcount over 20... that's not very useful in this case. Is there a way around that?
    – singpolyma
    Dec 20, 2011 at 16:09
0

Maybe denyhosts would be a useful tool for you.

Improve this answer
2
  • I'm using denyhosts already for ssh traffic, yes :)
    – singpolyma
    Dec 20, 2011 at 16:08
  • Denyhosts needs an auth log to read... These are not failures of any kind, just DNS queries.
    – adaptr
    Dec 20, 2011 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .