Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I run an number of high traffic websites and suffer from abusive users.

I'd like to firewall them and direct them to say apache on port 8080 serving a message like

You have been blocked, contact blabla

Is this possible with iptables?

share|improve this question
    
Having thousands of iptables rules is pretty expensive, at least if you have a few thousands packets per second. If you reach such quantities, consider abandoning that message and terminate the connections as early as possible in the chain. –  3molo Mar 12 '12 at 12:56

5 Answers 5

Manual updates of iptables is fine, if it's only a few IP addresses.

If there are a lot of them, take a look at Fail2Ban for automatic updates of the firewall, from a python script that parses your Apache log file, for example.

share|improve this answer
    
fail2ban is an excellent friend to have around! –  Janne Pikkarainen Mar 12 '12 at 12:54
    
Yep.. I've been using it for a long time now and I gotta say it's doing a hell of a job! –  tftd Jul 8 '12 at 23:40

Sure.

/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -s w.x.y.z -j DNAT --to-destination a.b.c.d:8080

where w.x.y.z is a hostile address, and a.b.c.d is your own address.

share|improve this answer

cjc offered you fail2ban, which is an excellent tool.

You did not specify what is 'high traffic' and if your web servers are CPU intensive or not. If you have some CPU cycles to burn, mod_security is also excellent for blocking unwanted visitors. It can block known blacklisted IP addresses right away, and also can block requests containing some nasty stuff.

mod_security contains lots of rule sets out of the box and you can download more around the net and/or create your own rules. Consider it as a SpamAssassin for HTTP traffic.

Depending on your needs mod_security might be overkill for you and fail2ban a better solution. Take a look at mod_security and decide for yourself.

share|improve this answer

Is there any reason not to use Apache itself?

<Directory />
    Allow from any
    Deny from 198.51.100.37
    Order allow,deny
</Directory>

The result for a user coming from 198.51.100.37 is a 403 error.

share|improve this answer

As others have suggested you can use fail2ban, mod_security, mod_evasive and even redirect them to another host (the last is simply pointless because you'll waste resources).

My approach is a bit different - I usually limit the maximum connections an IP could have to a specific port per second. For example I set somewhere near 20-30 connections per second per IP:

iptables -p tcp --dport 80 -m connlimit --connlimit-above 20 -j DROP

So if somebody is flooding your server this will help stopping it. I would also recommend using fail2ban as it's the best tool you'd find. It could parse pretty much every kind of log you throw at it and you can customize the actions fail2ban will perform against the abusers.

P.S. You can also checkout my answer to a similar DoS/DDoS question here which could help you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.