1

I am currently being flooded by requests to /wpad.dat - in a manner that makes it seem to be an attack.

Now, what I would like to do is to trigger iptables for every IP that requests /wpad.dat and then add it to a blacklist. Is there a way to do that? That means that the IP will be able to send one flood request and then none.

Any neat way to do this efficiently?

Improve this question
2
  • 2
    Usually those requests are from proxy discovery ...are these requests coming from Internet sources?
    – Nathan C
    May 24, 2013 at 13:25
  • Yes, thousands per minute. Very odd, I can't explain it. Totally bogs down my server
    – Sandman
    May 24, 2013 at 13:33

2 Answers 2

Reset to default
2

You might consider that there are other ways to block IP addresses. For example, Fail2ban is designed to scan log files for given patterns and temporarily block IPs.

As mentioned in the comments, you may potentially be adding thousands of IPs to your blacklist. While iptables works, each additional rule can increase the processing time for each request. You can use ipset as an alternative, which appears to be much faster when there are many IPs added. It takes a hash approach to speed up matches. See Mass-blocking IP addresses with ipset for details and comparsion between iptables and ipset.

If you want to use iptables, it would probably depend on how your webserver is set up. Supposing you use apache or nginx, you could set it to trigger a cgi script of some sort to run when wpad.dat is requested.

For example, if your website already uses php, you might use an internal rewrite to trigger a php script (or ruby/python/java depending on the language you normally use).

Once the script runs, just get it to run something like this on the command line:

iptables -I INPUT -s {IP-HERE} -j DROP

The script needs to be executed as root, and it is probably not a good idea to give the web user root privileges, so you can package it up as a shell script, chown it as root, and use setuid on it.

Big Warning: You could accidentally block yourself if you visit that resource, so you might want to set --dport to port 80 or something like that. This at least avoids blocking your ssh protocol, so if you manage to block yourself, you can ssh into your server and un-block yourself.

Expiry: Since permanently blocking many IP address is rarely a good idea, you might want to keep track of the IP address blocked (perhaps append it in a log file), and create a cron job to delete those IP addresses periodically. You just need to run something like:

iptables -D INPUT -s 192.168.1.100 -j DROP
Improve this answer
5
  • Thank yiou, I am currently doing something similar, by grep:ing the log file rather than running a PHP script for every thousand per minute request. So I am grep:ing the log file, adding the IP to the block (minding not to block my IP. Then I save the grepped IP's and save to a blacklist. I've used this script for about ten minutes and it's up to 857 hosts already, that have made more than ten thousand requests. This is some serious clobbering going on. But the block is working and the web server is working again, however, I',m not too fond of this solution
    – Sandman
    May 24, 2013 at 13:38
  • Take a look at Fail2ban, based on the features list, it appears to do what you want, and you can setup patterns for it to look for.
    – ronalchn
    May 24, 2013 at 13:42
  • Yes, but using my script above, I am already poopulating the iptables list with over 1000 hosts, which surely can't be a good way to handle this?
    – Sandman
    May 24, 2013 at 13:50
  • if you are concerned about performance, check out ipset (added to answer).
    – ronalchn
    May 24, 2013 at 14:00
  • Thank you, but ipset seems to require a new kernel compilation, and this being a production server, it's not a short term solution. I'll keep it in mind, however. Thank you.
    – Sandman
    May 24, 2013 at 14:18
1

Blocking automatically isn't exactly trivial with iptables, but instead you can throttle the connections so it's not hogging all your resources by adding this rule:

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT

Improve this answer
2
  • Thank you, I'll try it out. But for what it seems - I am getting more and more hosts in my blacklist, suggesting it's a spread botnet attack. In just a couple of minutes, the number of unique hosts that had spammed this was over 1000 hosts
    – Sandman
    May 24, 2013 at 13:52
  • The throttling is global which will help prevent your blacklist from growing really large.
    – Nathan C
    May 24, 2013 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .