Firewall requests that think you're another host

Question

I'm a bit of a noob so bear with me.

I routinely check my logs for fun and I got many (thousands) of these errors: http://pastebin.com/i0iSKDCW

The server I'm having problems with is a Burst.net VPS and I'm wondering if I've been allocated someone else's old IP and they left their domain configured or somesuch?

What I want to do, is use iptables or somesuch to deny all requests like this (with the host: eciou.net) without letting them get to Nginx (I have some slow software running underneath Nginx).

Solution

As suggested by the wonderful people below, I simply added this to my configuration file:

server { listen [::]:80; server_name eciou.net; location / { root /srv/http/static/eciou; index index.html; } }

Note that the [::]:80 is because my server is also set up to accept IPv6. Normally I believe just 80 would do.

Answer 1

Yes, you most likely got an IP that was used before to host the eciou.net domain.

Unfortunately, there is no easy way to filter such requests with iptables, because it is running on a lower OSI model level and it doesn't know anything about the Host: ... HTTP header.

You can filter such requests in nginx and prevent them from reaching your heavy software. This can by done by using the $host environment variable: http://wiki.nginx.org/HttpCoreModule#.24host

Here is a quick example that will return 404 for requests to this domain:

if ($host ~* "eciou.net") {
    return 404;
}

Answer 2

I would suggest returning 404 for all these requests, because.. well, because 404 means "Not Found" and that's really happening here.

E.g.:

server {
  listen 80; # only port means "listen all interfaces"
  server_name eciou.net;
  log_not_found off; # if you do not want to log all these 404's
  root /srv/http/static/eciou;
  location / {}
}

In this setup, Nginx will search the filesystem for the files requested. Not a big deal, but if you are concerned, return 404 will be more effective (instead of root + location)