Our webapp is being hammered by some people in a university in china. They've written a bot that is hitting our signup/signin end points. We've deleted the accounts but we'd really like to cool off the constant hits on those endpoints as well.
Our ubuntu server is configured with ufw and i'd really like to know how i can deny their whole network. I'm going to do this carefully by scanning the logs each day.
I've been looking at the UFW documentation and i'm fairly close to the answer.
sudo ufw deny from <NETWORK/MASK>
Need help in determining the network and mask. Given that I have a.b.c.X as the IP address where X varies from 1 to 255. How do i block this network? Can someone please explain in plain speak how to express the network in a.b.c.0/8 or a.b.c.0/12 /16 etc mean?
I'm not comfortable with fail2ban, so please dont suggest that as an option. I'm keen on deciphering ufw only.