Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I blocked an IP with this command first:

route add -host x.x.x.x reject

I still see the traffic in iftop. I tried adding this rule in iptables:

-I INPUT -s x.x.x.x -j DROP

Still, when running iftop it shows up at the top. Is there a way to block it completely?

Note that this is a VPS and I'm unable to configure any firewalls.

share|improve this question
3  
Block it from doing what precisely? You can't stop it from sending packets to your IP address. You can stop yourself from answering them, which I suspect you are already doing. –  David Schwartz Jan 10 '13 at 20:41
    
Block completely from the machine - it was a DoS attack. I was uncertain of the under works, so I suppose all I needed was a clarification. –  Oscar Broman Jan 10 '13 at 20:51
    
If the DoS attack is hurting you by consuming your CPU processing the requests, then you don't need to block it from the machine, just block it from being processed. If the DoS attack is hurting you by consuming your outbound bandwidth, then again you don't need to block it from the machine, just block the replies. It's only if it's hurting you by consuming your inbound bandwidth that you need to block it completely from the machine to solve the problem. Of course, that cannot be done from the machine. By the time it gets to the machine, it's too late. –  David Schwartz Jan 10 '13 at 20:54
1  
Also do note that if you add an iptables block rule, to be fully effective it must come before any accept rules that might match, including any rules with a "matching previous connections" criteria. It looks like you are doing that, but it's important to remember. –  Michael Kjörling Jan 10 '13 at 20:57
    
@MichaelKjörling I have a file with my iptables configuration, and I put the blocking line at the top. After that I use iptables-restore < /etc/iptables.rules. –  Oscar Broman Jan 10 '13 at 21:18
add comment

1 Answer 1

up vote 8 down vote accepted

As iftop's description says, it will "display bandwidth usage on an interface by host". So if you don't want the traffic to show up on iftop, you have to stop it before it consumes that interface's bandwidth. That would require stopping it at the source or on a firewall or other device before that interface.

Have you sent an email yet to the contact(s) for the networks or systems sending the unwanted traffic? Most of the time, that works.

share|improve this answer
    
I will do that. Thank you! –  Oscar Broman Jan 10 '13 at 20:45
    
Be polite. Include logs, particularly source IP address, destination IP address, timestamps (including time zone!), and approximate traffic volumes if possible. If their machine has been compromised, you are doing them a favor. –  David Schwartz Jan 10 '13 at 20:46
    
I'm quite new to this, sorry! –  Oscar Broman Jan 10 '13 at 20:52
    
Nothing to apologize for. You'll probably be surprised at how well a polite email works, at least during regular business hours. This abuse contact database may be helpful. –  David Schwartz Jan 10 '13 at 20:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.