2

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best way to throttle /ban these for a few minutes / hours? Can CSF for example do sg like this? I am really looking for a quick and dirty solution.

2

1 Answer 1

2

Iptables could be used to that end.

Blocking parallell connections:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit \
     --connlimit-above 20 -j REJECT --reject-with tcp-reset

Blocking floods (block more than 10 connections per minute) :

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent \
   --update --seconds 60 --hitcount 10 -j DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .