Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a bit of a noob so bear with me.

I routinely check my logs for fun and I got many (thousands) of these errors: http://pastebin.com/i0iSKDCW

The server I'm having problems with is a Burst.net VPS and I'm wondering if I've been allocated someone else's old IP and they left their domain configured or somesuch?

What I want to do, is use iptables or somesuch to deny all requests like this (with the host: eciou.net) without letting them get to Nginx (I have some slow software running underneath Nginx).

Solution

As suggested by the wonderful people below, I simply added this to my configuration file:

server { listen [::]:80; server_name eciou.net; location / { root /srv/http/static/eciou; index index.html; } }

Note that the [::]:80 is because my server is also set up to accept IPv6. Normally I believe just 80 would do.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Yes, you most likely got an IP that was used before to host the eciou.net domain.

Unfortunately, there is no easy way to filter such requests with iptables, because it is running on a lower OSI model level and it doesn't know anything about the Host: ... HTTP header.

You can filter such requests in nginx and prevent them from reaching your heavy software. This can by done by using the $host environment variable: http://wiki.nginx.org/HttpCoreModule#.24host

Here is a quick example that will return 404 for requests to this domain:

if ($host ~* "eciou.net") {
    return 404;
}
share|improve this answer
1  
would be better to used server block for it so that it runs during the normal host comparison instead of doing an additional check for each request. –  Martin Fjordvald Jul 10 '11 at 15:31
    
Makes sense, indeed. –  Vladimir Blaskov Jul 10 '11 at 15:35
    
So where exactly do you suggest I put it? –  user61832 Jul 10 '11 at 15:36
    
And thanks for the amazing and fast response too ^.^ –  user61832 Jul 10 '11 at 15:36
1  
Well, like Martin F suggested, there's a better solution than the above example. Simply define a new virtual host for eciou.net and point it to an empty directory. –  Vladimir Blaskov Jul 10 '11 at 15:53

I would suggest returning 404 for all these requests, because.. well, because 404 means "Not Found" and that's really happening here.

E.g.:

server {
  listen 80; # only port means "listen all interfaces"
  server_name eciou.net;
  log_not_found off; # if you do not want to log all these 404's
  root /srv/http/static/eciou;
  location / {}
}

In this setup, Nginx will search the filesystem for the files requested. Not a big deal, but if you are concerned, return 404 will be more effective (instead of root + location)

share|improve this answer
    
That's basically all I did :) –  user61832 Jul 12 '11 at 7:09
    
I outlined 2 variants, you cannot do both of them at the same time. –  Alexander Azarov Jul 12 '11 at 9:00
    
Ahh, sorry. I pointed it at an empty directory :) –  user61832 Aug 24 '11 at 0:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.