0

I'd like to find a way to block websites like https://checkip.amazonaws.com or at least restrict them to the point they can no longer output my server's public IP address.

For example, if I do curl https://checkip.amazonaws.com my output would simply be 1.1.1.1 (or in other words, my IP address).

Is there a way to have an app that would inspect the output of each website my server tries to connect to and if the output contains a specific string, it automatically blocks it?

I know a way to block them one by one, but is it possible to block all similar websites based on their output?

But why?!

The reason is simple. There are people hosting game servers on a dedicated server. However, with extensions to those servers, people can easily find the public IP of the machine they are on. The public IP is hidden via reverse proxy for network protection. If a user finds the real IP of a machine, they can use it to perform an attack or do other malicious activities.

Thanks!

Improve this question
2
  • Block all https traffic by sniffing the traffic and drop all connections that shows your ipv4 and IPv6 addresses. You might be able to block both port 80 and 443, but nothing prevents someone running a http service or something else on some other port.
    – NiKiZe
    Nov 7, 2021 at 9:13
  • 1
    If your goal is to stop people from connecting directly to the server's IP, block all inbound connections except from your load balancer?
    – chedabob
    Nov 11, 2021 at 17:05

2 Answers 2

Reset to default
5

Don't bother, you are fighting against windmills. This is just one of an endless list of services that show your IP address, you will never be able to block them all.

And even if you could, the user could just run his own anywhere he wants.

Restricting outgoing IP connections would be more useful, if that doesn't disrupt your services.

Improve this answer
0

the easiest thing to do is put an entry in your local machine /etc/hosts for checkip.amazonaws.com and point it at whatever IP you wish. Point it to the machine's IP or simply to 127.0.0.1. Or setup a machine on your network that collects those requests and point checkip.amazonaws.com to that machine's IP and find out when people try to do this. There are other sites that will give you the public IP your traffic comes from however, so this one may not be the only one they're using.

However, if you know the miscreants mostly use this one, an entry in the system's /etc/hosts file will put a stop to it, pronto! Child's play!

Improve this answer
4
  • 1
    You don't even need a DNS entry for such a check, you can just connect to the IP address of the service. This is useless.
    – Gerald Schneider
    Nov 7, 2021 at 7:13
  • most people don't know IPs for services. That's why we have DNS. Plus unless it has been purposefully reconfigured, most systems consult hosts files before network name services like DNS, NIS, NIS+, or LDAP so this solution will effectively put a stop to someone using the checkip.amazonaws.com service, by name. Put the entry in the hosts file and point it at the localhost or some other system on your internal network to track when and from which system those calls are being made.
    – t3ln3t
    Nov 7, 2021 at 18:29
  • 1
    You are missing the point. If I wanted to get the IP address of said server I could just look up the IP address of the service somewhere else and run curl -H "Host:checkip.amazonaws.com" http://52.6.167.215. No DNS lookup necessary on the server. Your hosts entry wasn't even used.
    – Gerald Schneider
    Nov 7, 2021 at 18:41
  • Yes, I already know how to block this specific host. I'm asking for a solution that would check output of each website the server tries to connect to, inspect if there's specific string there and if there is block the connection (like a middle proxy).
    – OpenSource
    Nov 8, 2021 at 18:26

Not the answer you're looking for? Browse other questions tagged .