Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I was searching for a solution a long time but cant find anything useful.

My webserver is secured by a firewall (iptables with ufw userinterface). Default is deny all and only some ports are open. The server is monitored by prtg.

My problem is, that someone is trying to access the blocked ports a few times per seconds. If this happens, the monitoring tool reports a ping timeout.

The simple DDOS deflate script is configured to block on more than 100 requests. This amount is not reached.

My question: is it possible to prevent this incident? Is a block by the firewall this performance hungry?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3 Answers 3

up vote 1 down vote accepted

There are a lot of different answers here, but in general a software firewall is not intended to stop DoS attacks. Yes, when a large volume of traffic is being sorted by a firewall it is resource demanding. If this is just one person trying to access these blocked ports, it is possible to contact your hosting provider and block the IP on the backbone so it doesn't reach your server.

Depending on the size of your site / application it may be time to start looking at a hardware firewall.

Here is another answer of mine on a similar topic:

How protect from DDOS attack?

share|improve this answer

My best guess is that your ufw rules are logging all the blocks; I have seen in the past that this creates a LOT of disk activity and the system becomes too busy to handle anything else (such as other incoming packets).

Reduce your logging level, or add rate-limiting to your log rule(s).

share|improve this answer

I have seen iptables with over 2,000+ rules and works perfectly fine, not saying having "2,000+" rules is a good thing, its definitely about time to switch to more robust firewall solution. but you get the point.

performance wise, answer is no

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.