Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i want to block ever ip addresses that have 50 connection per min . what am i going to do ? should i write a basic code ? Thanks in Advance .

share|improve this question

migrated from stackoverflow.com Nov 22 '10 at 19:37

This question came from our site for professional and enthusiast programmers.

3 Answers 3

I think I had to install iptables from source to get the higher number of hits to work correctly..

-A INPUT -p tcp -m tcp -m state --state NEW -m recent --set --name TCPRATE --rsource
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j LOG --log-prefix "TCP Rate Exceeded: "
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j DROP
share|improve this answer

I also had some brute attacks from a certain IP, here is how I blocked the IP via iptables.

(1) edit iptables

vi /etc/sysconfig/iptables

(2) add a line on the top of -A list (if you add it in the lower part, there is a chance it might not work because earlier conditions are met so the packets you are trying to block are still allowed to go through... I had this problem in the beginning and finally found the reason)

-A INPUT -s xxx.xxx.xxx.xxx -j DROP

(3) restart iptables

/etc/init.d/iptables restart

That's it. Finally I don't see the connection messages in the server log anymore.

I also found people are saying to use 'fail2ban'. You may want to try it if there are multiple IPs (& changing) trying to connect to your server.

share|improve this answer

Look at this Debian Administration article on rate limiting connections. Or look at this http://www.shorewall.net/Actions.html#Limit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.