How do you deal with malicious IP's?

Question

I'm trying to figure out how to protect my server against what it seems to be a botnet (I'm just guessing)

Everyday, more and more IP's fill my application logs with invalid request (eg: GET requests to url's that should be receiving only POST requests)

First I thought about logging all those IP's based on both a) the fact that they are making invalid requests and b) the amount of request per unit of time, and then just run a cron that grabs those ips and adds rules to iptables to drop their packets.

But reading a little about it I found that many problems can arise from this approach:

• The IPs being banned could be from valid users, who got their PCs infected, and I don't want to ban them for good. Banning them for a day would be enough I think. Is there a way to put expiration on the rules? Or do I have to save a 'base' iptables config, and at the end of the day remove all the rules and reload that base config?
• The IPs could be totally fake. I didn't know that was possible =s. How do you protect a server against this?
• Iptables can slow down the server if we add too many rules. Someone mentioned that it was possible to ban ips without adding rules to iptables. Is that possible? Is there a scalable way to ban lots of IPs?

Any thoughts?

Answer 1

This is part of the Internet noise which all Internet connected computers experience, unfortunately we don't live in a perfect world. Trying to prevent it is like playing a cat and mouse game. You can use Iptables rate-limiter to limit the number of incoming requests from an IP but thats about it.

Instead insure that your application and OS is secure. Keep up with the security patches whenever possible and follow secure coding guidelines. Also configure the services correctly, one of the biggest security flaw is mis-configured services.

Answer 2

Don't bother with IP banning rules - as you suspected, source IPs can be faked, an automatic ban would just create another denial of service attack vector against your host.

In most cases you can ignore invalid requests - those are worms or automatic scripts blindly trying to exploit security holes which might or might not be there. Hold on to Sameers advice of patching up your system and applications (especially your PHP applications, as they usually are quite erroneous and are exploited frequently). Only act on traffic if it is impacting your server's performance (e.g. a large number of non-legitimate requests is using a lot of your server's resources). Even a plentiful bunch of iptables rules would hardly cause any load with modern hardware.

Answer 3

If you want to go the IP banning route with iptables, then use fail2ban. It will watch your log files for bad IPs and block them for defined amount of time.

Look at using a layer 7 firewall like mod_security for Apache.

Recently I resolved a bunch of major performance problems for a customer. They had over 7000 iptables rules to blacklist various IPs. Removing these fixed major network performance issues. It seems like iptables can't handle more then a couple thousand rules.

Creating a blackhole route for unwanted hosts probably performs better. This could mean having a lot of extra small routes, but Linux handles that fine.