Here is the scenario:
I intend to protect my server from being queried with high frequency from the same IP, say, the upperbound is 60 times per minute.
I don't know how to do that via iptables, Is there any tools or bashes that can solve this problem? I'm really new to the security of Linux, and I need my server to be protected from being attack via robot program. Thanks a lot!
To limit hit rate from a specific IP using iptables you can do the following:
-A INPUT -p tcp --dport 80 -i eth0 -s 1.2.3.4 -m state --state NEW -m recent --set
-A INPUT -p tcp --dport 80 -i eth0 -s 1.2.3.4 -m state --state NEW -m recent --update --seconds 60 --hitcount 60 -j REJECT
This rejects packets from IP 1.2.3.4 if it hits port 80 on eth0 more than 60 times per 60 second period.
-i eth0 if I got multiple interfaces on my server?
-i eth0 to make the rule match all interfaces. The same goes for --dport 80 and -p tcp -- if you omit them the rule will match all ports and protocols.
iptables will solve your problem. if it is a publicly open service, such as apache, you can rate limit.
if it is a private service that is being bombed, such as is commonly sshd (tcp/22), due to most distros having it open globally by default, then simply restrict access to it from only your ip. this goes for all private services, such as ftp for instance, not just sshd
