up vote 0 down vote favorite
share [g+] share [fb]

is there any way to tell Windows Firewall (on Server 2008) to restrict IP addresses to a certain number of connections on port 80?

I've done a netstat -noa and established that each IP address is opening many connections to port 80, like so:

  TCP    87.117.000.000:80       85.196.000.000:1758    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1765    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1788    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1821    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1838    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1849    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1934    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:1981    TIME_WAIT       0
  TCP    87.117.000.000:80       85.196.000.000:2002    TIME_WAIT       0

(IP addresses zeroed to protect guilty and innocent!). The IP addresses keep changing but I guess we could limit the impact of the firewall could deny connections after a certain number are open?

We're blocking requests at the IIS level using the dynamic IP address blocking module but that's not doing enough.

Unfortunately we don't currently have a hardware solution in place to be able to deal with this so looking at what we can do temporarily?

Thanks!

link|improve this question
Hmm... many connections originating from the same ip address in the Time_Wait state sure does look like a DOS attack, although I wouldn't consider it a DDOS as the originating ip address is the same. So you have no firewall at the perimeter of your network? How about your router, any capability to block these connections? – joeqwerty Sep 9 '10 at 11:59
that's just an extract - there's hundreds of different IPs that come and go. our data centre have told us there's nothing they can do, so looking at options while we try and get a more permanent hardware solution in place – James Crowley Sep 9 '10 at 13:20
I see. What stands between the server and the data center network\router\firewall? Nothing? – joeqwerty Sep 9 '10 at 14:49
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.