Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Virtual Dedicated Server hosts 10 websites. 1 firewall made with iptables

If one of those 10 websites gets hit by too many ping requests coming from one IP address, how do I limit or drop it without dropping it for the other 9 websites?

Do I create a firewall for every website ? If so, how? Or is it better to change my rules? If so, how? Thank you.

Original question was posted here iptables: what's best practice when there're several websites but you want to use a rule for a single website? but it was too vague.
Let me know if more info is needed.

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

If one of those 10 websites gets hit by too many ping requests coming from one IP address, how do I limit or drop it without dropping it for the other 9 websites?

Iptables and Netfilter primarily operate at the Internet layer. This means it mostly can only make decisions about packets based on information in the IP, TCP, and UDP headers. Generally, the criteria you are limited to includes the IP protocol, the source and destination network addresses, and ports from (UDP/TCP). You can also do things with state but this is built up by the firewall and gathered from an internal table. There are a few exceptions to this where some special kernel modules are designed to look deeper into the packets for complex protocols like SIP, H.323, and FTP.

If your different web sites have different IP addresses then building up a rule is trivial. If all those sites are on a single IP then you are pretty much out of luck.

share|improve this answer
1  
P.S. As for other questions about how to build a firewall and how to enter rules, I would ask that you do a bit more of your own homework first. Right now your question is so vague that it would take a 500 page book on iptables/netfilter to fully answer. –  Zoredache Mar 26 '12 at 16:49
    
Zoredache. I'm working on it :) I wasn't really asking how to build a firewall though. If the solution was to build a firewall for every site, then I wouldn't know how to set that up on the server. –  Kris Mar 26 '12 at 17:32
    
That being said, I need to make sure I have different IP addresses. I didn't know for sure that was the only option I had. Thank you for your help. –  Kris Mar 26 '12 at 17:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.