Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having a problem with comment spammers. Well at least I think I am. I am running CentOS and my Apache webserver keeps maxing out on RAM and then becomes unresponsive and crashes. If I run the following command:

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

Then I get this list of connections that are open:


Searching those IPs on the website told me that they are comment spammers. So I thought I would just ban them using iptables with this command:

iptables -A INPUT -s -j REJECT

I have also tried using the command:

iptables -A INPUT -s -j DROP

I then saved the state with: service iptables save

If I run the nestat command again, those IPs are still connected and some of their connections have increased in number.

Does anyone know what I am doing wrong? service iptables status does show iptables is running and has those rules in it. So I am completely stumped. Any help would be greatly appreciated.

share|improve this question

Without actually being able to see your full firewall configuration, my guess is that you have a mistake somewhere. Inbound traffic might be allowed by some other rule, such as one allowing RELATED and ESTABLISHED traffic, or allowed by port or destination. Moving the DROP or REJECT rule up in the chain will make it match earlier and not be overridden by a different rule.

Also, if inbound traffic is being blocked, then existing connections will technically still be considered "open" until your computer decides that the other server isn't responding. And if your computer isn't trying to communicate with the remote machine, then it will never know that there's no response on the other side.

share|improve this answer
+1 for the point about RELATED,ESTABLISHED - that would be my first thought. – David Z Jul 9 '10 at 7:24

I had the same problem.

Here is how I solved it by editing /etc/sysconfig/iptables

Move the blocking line, such as


to the top of the -A list,

then I don't see any brute attack messages from that IP anymore.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.