Here's the deal: I have a persistent Chinese botnet that spams my forum (running on an Ubuntu 12.04.2 server on nginx, etc). I've been using UFW (Ubuntu's "Uncomplicated FireWall") for managing the firewall, just as a simple way to not have to deal with iptables.
I've identified the extremely consistent and unique (not to mention dumb) URL that it attempts to load each time a bot hits, and from that made a cron to parse the access logs every hour and find new attackers, and
ufw deny from [ip-address] on them.
However, the onslaught just doesn't stop. It's incredible. I'm logging each blocked IP, and it's up to almost 17,000 IPs. 98% of the IPs are from China, with a few here and there from other countries.
This appears to be working well: in practice, all those attacks are blocked, and the connections have gone back to normal, traffic has gone down exponentially, and the effective DDOS has stopped (if I let these clients through, the volume and speed of the requests is staggering).
UFW also seems to be okay with it. Nothing is slowing down, requests are being served with the same speed, latency hasn't suffered as far as I can tell. I've tried combining the individual IPs into ranges as much as possible, but it would be difficult to figure out all of them, and would block an order of magnitude more IPs than are actually causing problems.
So, some questions:
- How many rules (presumably iptables when all is said and done) can I reasonably have before I should be worried?
- Is there any possible negative effect to continuing this exact practice?
- Any suggested changes or improvements?
- Does anyone know about this bot? It's attacking bbPress. Is there a better way to prevent attacks like this rather than treat the symptoms?
I don't want to block all of China, unfortunately, since I know we have users there...