Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My webserver (nginx) keeps getting requests like this:

23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET http://ib.adnxs.com/ttj?id=2947236&size=300x250&cb={CACHEBUSTER}&referrer={REFERRER_URL}&pubclick={INSERT_CLICK_TAG} HTTP/1.0" 200 612 "http://www.businessfull.net/?p=8167" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit/534.15+ (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4"
216.244.65.21 - - [15/Jun/2014:21:21:47 -0400] "GET http://ib.adnxs.com/ttj?id=2583052&referrer=http%3A%2F%2Fwww.excitingflashgames.com%2Fgame%2Frun_chicken_run.html&cb=78488 HTTP/1.0" 200 612 "http://www.excitingflashgames.com/game/run_chicken_run.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.2 (KHTML, like Gecko) Ubuntu/11.04 Chromium/15.0.871.0 Chrome/15.0.871.0 Safari/535.2"

There are hunderds of these requests and they cause my http server to be a lot slower. Is there some way I can block this using iptables? The weird this is that they are trying to visit sites that I don't even host. I thought this would be usefull in banning them but I'm not sure how I would do that.

share|improve this question
    
Haven't used nginx as a web server yet, but maybe you can do something with it if you're just dealing with a hundreds? i don't like to question the scalability of nginx but with 'hundreds' affecting the performance of your web server, i just can't. –  user226424 Jun 16 at 2:47

3 Answers 3

up vote 6 down vote accepted

This is an example of a well known proxy abuse exploit. Some versions of Apache (which have the proxy module installed) are often are left improperly configured or not secured, and allow anybody to route a request through your webserver, in effect, turning it into an unwitting and illicit proxy server (which could be used in an unpleasant attack).

Although tomtom recommends offloading your security to CloudFlare, the solution is fairly simple, and should be implemented as a part of any basic security audit (even for the most basic of websites).

Building on Vinícius Ferrão's answer; After you install Fail2Ban, you will need to setup a filter (on debian/ubuntu, create the file /etc/fail2ban/filter.d/nginx-proxy.conf).

In this file, enter this:

# Block IPs trying to use server as proxy.
#
# Matches e.g.
# 192.168.1.1 - - "GET http://www.something.com/
#
[Definition]
failregex = ^<HOST> -.*GET http.*
ignoreregex =

and then create this block inside the fail2ban configuration file (usually under /etc/fail2ban/jail.conf):

## block hosts trying to abuse our server as a forward proxy
[nginx-proxy]
enabled = true
port    = 80,443
filter = nginx-proxy
logpath = /path/to/websites/access.log.file
maxretry = 2
bantime  = 86400

(replacing logpath = with the path to the access log of your website)

This will use the default blocking mode to ban hosts trying to abuse your site as a forward proxy.

Afterwards, I would consider checking your nginx configuration, and use controls to prevent anybody from making these requests to your server (if not from a specific IP).

Hope this helps!

share|improve this answer
1  
Not only did your answer solve my current problem, it will also solve any future problems because of the awesome examples in your post. Thank you! –  HiddenKnowledge Jun 18 at 0:43
    
glad I could help! :) –  RapidWebs Jun 18 at 19:49

This should not be the case, but if you're getting a lot of requests from the same source constantly and this is causing a Denial of Service (DoS) on your server you should consider using something like fail2ban to temporally ban abusive clients from your server.

Anyway it's a good idea to avoid bruteforce attacks for example, if you don't have some security appliance before your final destination (your server).

You can get more information about fail2ban on it's website: http://www.fail2ban.org and there are some configuration tips to use fail2ban with nginx over here: http://www.fail2ban.org/wiki/index.php/NginX

share|improve this answer

Welcome to the internet. Where bots galore try finding exploits in every server connected.

Live with it. There is nothing you sensibly CAN do.

There are hunderds of these requests and they cause my server to be a lot slower.

You run your server on like 50 year old hardware=? because even the smallest VPS would not really bulget and get a lot slower with hundreds such requests per second.

share|improve this answer
    
I meant my http server, not my entire server. I edited the question. –  HiddenKnowledge Jun 16 at 2:29
1  
Irrelevant. The statement stands. The traffic should not matter at all. Not even on my phone. –  TomTom Jun 16 at 2:48
    
@HiddenKnowledge TomTom's cell phone runs a webserver capable of hosting some pretty decent websites. It's well documented. Regardless of his phone your webserver shouldn't even notice a few hundred requests unless someone is off. Vinicius has a great answer for the most basic defenses (mainly the evey popular fail2ban). –  Chris S Jun 16 at 3:15
    
Actually there is a better defence - do not defend at all ON YOUR SERVER. Use CLoudFlare to proxy your traffic. More speed and tehy handle all the crap requests.... for free. –  TomTom Jun 16 at 3:38
2  
in my opinion, leaving your server or infrastructure insecure, and offloading it on to somebody or someone else is not a valid (or responsible) response. furthermore, there are circumstances where this can interfere with treating a real attack, due to having messy and complex logs to sift through. moreover, as a website becomes more popular, it gets more traffic, and more bots hit your server. if this is causing slowness now, it will grow exponentially. therefore, implementing the simple fix should be done now, rather than later. –  RapidWebs Jun 16 at 4:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.