Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best way to throttle /ban these for a few minutes / hours? Can CSF for example do sg like this? I am really looking for a quick and dirty solution.

share|improve this question
Awesome, looks like the solution. Care to post it as an answer so I can accept it? – giorgio79 Aug 22 '12 at 15:13
up vote 2 down vote accepted

Iptables could be used to that end.

Blocking parallell connections:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit \
     --connlimit-above 20 -j REJECT --reject-with tcp-reset

Blocking floods (block more than 10 connections per minute) :

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent \
   --update --seconds 60 --hitcount 10 -j DROP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.