-1

Our webapp is being hammered by some people in a university in china. They've written a bot that is hitting our signup/signin end points. We've deleted the accounts but we'd really like to cool off the constant hits on those endpoints as well.

Our ubuntu server is configured with ufw and i'd really like to know how i can deny their whole network. I'm going to do this carefully by scanning the logs each day.

I've been looking at the UFW documentation and i'm fairly close to the answer.

sudo ufw deny from <NETWORK/MASK>

Need help in determining the network and mask. Given that I have a.b.c.X as the IP address where X varies from 1 to 255. How do i block this network? Can someone please explain in plain speak how to express the network in a.b.c.0/8 or a.b.c.0/12 /16 etc mean?

I'm not comfortable with fail2ban, so please dont suggest that as an option. I'm keen on deciphering ufw only.

0

1 Answer 1

3

I think this question should be on serverfault.com, but here is your answer:

if only X varies you have to specify /24 (CIDR-Notation) or 255.255.255.0 which is the equivalent network mask. (a.b.c.0/24)

Why is that: I think the wikipedia article is a good resource to start with, if you wanna know more about this. Wikipedia-CIDR

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .