'iptables' redirecting specific IP addresses

Question

I run an number of high traffic websites and suffer from abusive users.

I'd like to firewall them and direct them to say apache on port 8080 serving a message like

You have been blocked, contact blabla

Is this possible with iptables?

Answer 1

Manual updates of iptables is fine, if it's only a few IP addresses.

If there are a lot of them, take a look at Fail2Ban for automatic updates of the firewall, from a python script that parses your Apache log file, for example.

Answer 2

Sure.

/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -s w.x.y.z -j DNAT --to-destination a.b.c.d:8080

where w.x.y.z is a hostile address, and a.b.c.d is your own address.

Answer 3

cjc offered you fail2ban, which is an excellent tool.

You did not specify what is 'high traffic' and if your web servers are CPU intensive or not. If you have some CPU cycles to burn, mod_security is also excellent for blocking unwanted visitors. It can block known blacklisted IP addresses right away, and also can block requests containing some nasty stuff.

mod_security contains lots of rule sets out of the box and you can download more around the net and/or create your own rules. Consider it as a SpamAssassin for HTTP traffic.

Depending on your needs mod_security might be overkill for you and fail2ban a better solution. Take a look at mod_security and decide for yourself.

Answer 4

Is there any reason not to use Apache itself?

<Directory />
    Allow from any
    Deny from 198.51.100.37
    Order allow,deny
</Directory>

The result for a user coming from 198.51.100.37 is a 403 error.

Answer 5

As others have suggested you can use fail2ban, mod_security, mod_evasive and even redirect them to another host (the last is simply pointless because you'll waste resources).

My approach is a bit different - I usually limit the maximum connections an IP could have to a specific port per second. For example I set somewhere near 20-30 connections per second per IP:

iptables -p tcp --dport 80 -m connlimit --connlimit-above 20 -j DROP

So if somebody is flooding your server this will help stopping it. I would also recommend using fail2ban as it's the best tool you'd find. It could parse pretty much every kind of log you throw at it and you can customize the actions fail2ban will perform against the abusers.

P.S. You can also checkout my answer to a similar DoS/DDoS question here which could help you.