Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a spambot that likes to spam my websites. I mailed to abuse@isp, but he ignored me.

Attacks always come from the same ip, and i used IISIP to add the spammer IP to all of my websites.

I am wondering, since i am using a linux box with shorewall as a firewall... maybe is better to filter at that level?

Which one has better performance with a list that might grow and become huge? IIS giving a 403 page to the spammers, or shorewall dropping the connections?

share|improve this question
    
Ignoring mails that come to abuse@isp is plain rude. People send mail to abuse@ as last resort, because they need help, not because they want to screw up somebody's weekend. If that wouldn't affect my business, I'd go mad and block the whole ISP at the firewall level. –  Anonymous Jan 26 '10 at 17:16
add comment

3 Answers

up vote 13 down vote accepted

If you are getting a lot of traffic from these spambots, then you are best to drop them at the firewall. Dropping at IIS means putting extra load on your web server (even if it is just serving 403 pages) and if it gets heavy then it could affect the performance for real users of your sites.

I'm not intimately familiar with Shorewall but I would also expect it is probably more efficient at this filtering than IIS will be.

share|improve this answer
    
Agreed with dropping them at the firewall. If the IP is hosting a spambot, there is a good chance they are being controlled in a large botnet and are compromised machines. You don't want them touching your hosts at all. Right now it is just spam but it could grow to include exploits or DDOS attacks. –  Dave Drager Jan 26 '10 at 14:22
add comment

Shorewall dropping is the best I guess. If you can get the IP addresses of these spammers you can dynamically block them with the command "shorewall drop/reject ipaddress'. You may even write a script which can do this in real time.

share|improve this answer
add comment

I agree with Sam. It's best to stop them at the perimiter of your network (at the firewall). Think of it like your office building or your home. Do you want to let the rogue into your office and hope that you've got everything inside secured and hope that you haven't forgotten or missed something or would you rather stop them at the door so that they can't get in at all?

share|improve this answer
3  
Excellent analogy –  Sam Jan 26 '10 at 15:11
    
@Sam Cogan: Thanks. –  joeqwerty Jan 26 '10 at 15:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.