i want to block ever ip addresses that have 50 connection per min . what am i going to do ? should i write a basic code ? Thanks in Advance .
3 Answers
Look at this Debian Administration article on rate limiting connections. Or look at this http://www.shorewall.net/Actions.html#Limit.
I also had some brute attacks from a certain IP, here is how I blocked the IP via iptables.
(1) edit iptables
vi /etc/sysconfig/iptables
(2) add a line on the top of -A list (if you add it in the lower part, there is a chance it might not work because earlier conditions are met so the packets you are trying to block are still allowed to go through... I had this problem in the beginning and finally found the reason)
-A INPUT -s xxx.xxx.xxx.xxx -j DROP
(3) restart iptables
/etc/init.d/iptables restart
That's it. Finally I don't see the connection messages in the server log anymore.
I also found people are saying to use 'fail2ban'. You may want to try it if there are multiple IPs (& changing) trying to connect to your server.
I think I had to install iptables from source to get the higher number of hits to work correctly..
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --set --name TCPRATE --rsource
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j LOG --log-prefix "TCP Rate Exceeded: "
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j DROP