Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is about a iptables, I wanna to know how can I block these ip for 1hour and not only a little time.. because they make to many sql requests, I'm using it for block but it's not enough because there's anyway 100k ip who attack then too much requests for sql server.

iptables -N SYN-LIMIT
iptables -A SYN-LIMIT -m hashlimit --hashlimit 8/second --hashlimit-mode srcip --hashlimit-name SYN-LIMIT -j RETURN
iptables -A SYN-LIMIT -j DROP
iptables -I INPUT -p tcp --dport 80 --syn -j SYN-LIMIT
iptables -I INPUT -p tcp --dport 80 -m connlimit --connlimit-above 6 -j REJECT --reject-with tcp-reset

How can I make the same but block IP for long time ? (Not manually !)

share|improve this question
    
Have you really exposed an SQL Server directly on to the internet? I do hope I've misunderstood you. (BTW the answer to your question is probably fail2ban) –  symcbean Jul 2 '13 at 16:41

1 Answer 1

You could use SET to store long-term banned ip, if your kernel supports it (2.6+).

You need to install ipset on your server and to create a set by issuing

ipset create http_abuse hash:ip timeout $TIMEOUT

where $TIMEOUT is the number of seconds an IP should stay banned.

Then, replacing your iptables rules by what follows should do the trick

iptables -N SYN-LIMIT
iptables -A SYN-LIMIT -m set --match-set http_abuse src -j DROP
iptables -A SYN-LIMIT -m hashlimit --hashlimit 8/second --hashlimit-mode srcip --hashlimit-name SYN-LIMIT -j RETURN
iptables -A SYN-LIMIT -j SET --add-set http_abuse src
iptables -A SYN-LIMIT -j DROP
iptables -I INPUT -p tcp --dport 80 --syn -j SYN-LIMIT
iptables -I INPUT -p tcp --dport 80 -m connlimit --connlimit-above 6 -j REJECT --reject-with tcp-reset

You can find more details and about IPset on IPSet website.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.