Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server occasionally get massively hit by (probably bots) on a small group of IPs. Is there a good way (probably in iptables) to slow down or temporarily block/tarpit connections coming from an IP that has connected many times recently?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Yes, iptables supports this kind of dynamic rate limiting.

See here for details: http://codingfreak.blogspot.com/2010/01/iptables-rate-limit-incoming.html

share|improve this answer
    
Hmm... it seems that I cannot set a --hitcount over 20... that's not very useful in this case. Is there a way around that? –  singpolyma Dec 20 '11 at 16:09

Maybe denyhosts would be a useful tool for you.

share|improve this answer
    
I'm using denyhosts already for ssh traffic, yes :) –  singpolyma Dec 20 '11 at 16:08
    
Denyhosts needs an auth log to read... These are not failures of any kind, just DNS queries. –  adaptr Dec 20 '11 at 16:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.