1

i want to block ever ip addresses that have 50 connection per min . what am i going to do ? should i write a basic code ? Thanks in Advance .

3 Answers 3

1

Look at this Debian Administration article on rate limiting connections. Or look at this http://www.shorewall.net/Actions.html#Limit.

0

I also had some brute attacks from a certain IP, here is how I blocked the IP via iptables.

(1) edit iptables

vi /etc/sysconfig/iptables

(2) add a line on the top of -A list (if you add it in the lower part, there is a chance it might not work because earlier conditions are met so the packets you are trying to block are still allowed to go through... I had this problem in the beginning and finally found the reason)

-A INPUT -s xxx.xxx.xxx.xxx -j DROP

(3) restart iptables

/etc/init.d/iptables restart

That's it. Finally I don't see the connection messages in the server log anymore.

I also found people are saying to use 'fail2ban'. You may want to try it if there are multiple IPs (& changing) trying to connect to your server.

0

I think I had to install iptables from source to get the higher number of hits to work correctly..

-A INPUT -p tcp -m tcp -m state --state NEW -m recent --set --name TCPRATE --rsource
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j LOG --log-prefix "TCP Rate Exceeded: "
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j DROP

You must log in to answer this question.