I'm trying to figure out how to protect my server against what it seems to be a botnet (I'm just guessing)
Everyday, more and more IP's fill my application logs with invalid request (eg: GET requests to url's that should be receiving only POST requests)
First I thought about logging all those IP's based on both a) the fact that they are making invalid requests and b) the amount of request per unit of time, and then just run a cron that grabs those ips and adds rules to iptables to drop their packets.
But reading a little about it I found that many problems can arise from this approach:
- The IPs being banned could be from valid users, who got their PCs infected, and I don't want to ban them for good. Banning them for a day would be enough I think. Is there a way to put expiration on the rules? Or do I have to save a 'base' iptables config, and at the end of the day remove all the rules and reload that base config?
- The IPs could be totally fake. I didn't know that was possible =s. How do you protect a server against this?
- Iptables can slow down the server if we add too many rules. Someone mentioned that it was possible to ban ips without adding rules to iptables. Is that possible? Is there a scalable way to ban lots of IPs?