Where to find and how to block blacklisted IPs and proxies?

Question

Good day everyone!

I'm looking for a way to block incoming requests from blacklisted IPs and proxies (mostly anonymous) to my server. While it's quite obvious how to do it using Apache config the main question is where can I find regularly updated list of such IPs?

Is there a "best practice" for doing this?

Getting deeper into the reasons for this: my website receives a huge incoming traffic from many different IPs mainly located in US. Almost every request defers one from another and that's why I can't block nor particular IP, nor the range of IPs by subnet. While it is not a true DDoS attack my dedicated server almost goes offline :/

I think that I need something like Fail2Ban and DenyHosts but based not only on password fails but on all incoming traffic.

Answer 1

There's an excellent howto for installing MoBlock on your server; it's written for Ubuntu, but the directions can be adapted for any distribution. This is a tool which lets you load arbitrary blocklists and translates them into firewall rules, so your server can discard the traffic quickly and efficiently long before Apache has to bother with it.

As for the blocklists themselves, there's the BISS IP Blocklists; they're mostly geared towards blocking entities that attempt to monitor peer-to-peer traffic, which they do quite well. They do however have a "Tor / proxy" list which purports to block open proxies and Tor routers, but I can't make any particular claim as to its accuracy or efficacy.

I also found a program called DDoS-Deflate which purports to automatically add firewall rules to block high-connection sources, but again, I've never used it myself so I can't tell you how well it works.

Finally, apparently iptables has a hitcount command that automatically rate-limits incoming connections:

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

This would limit incoming SSH connections to 8 per 60 seconds, and is already built-in.

Answer 2

There are a number of sites that purport to list "abusive" IPs. I like Project Honeypot, as it's free (if you participate in the network), and has reasonably open criteria for what gets you on the list. Otherwise, a Google search for "open proxy blacklist" seems to provide a lengthy set of results; I can't give any specific recommendations, but it's best if you analyse the options for your own needs.

Answer 3

Try ModSecurity: http://www.modsecurity.org/, combined with SSHBlack: http://www.sshblack.com/