0

I want to find out how to block HTTP floods fully. I was using this code right here:

iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m recent --set --name HTTP
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 50 --name HTTP -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW -m recent --set --name HTTPS
iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW -m recent --rcheck --seconds 30 --hitcount 50 --name HTTPS -j DROP

However... I want to perm firewall any IP that sends 50 hits within 30 seconds. I don't want it to unblock the IP after like 30 seconds. If I hold down the refresh button on my site with this script on, I get blocked for only like 30 seconds. I want it to PERM block any attacking IP address.

Does anybody have a solution to this question?

Improve this question
2
  • 1
    Please don't do this. IP addresses do not map to individual human beings.
    – gparent
    Dec 2, 2014 at 21:09
  • I know that... But people are always attacking my site for weeks without end. I would flush the blocked every now and then...
    – Jerry Longhorn
    Dec 2, 2014 at 22:15

1 Answer 1

Reset to default
3

You're looking for some software like fail2ban. However, there's a problem with your current setup: Anyone who can spoof IP traffic (large parts of the internet can) can get any IP address blocked from your server (including yours!).

It would be better to look into why someone continuously refreshing your site is causing issues. Perhaps you need to tune your database queries? Perhaps you need some caching?

It's better to fix this correctly now (by optimizing your site), so that if your site suddenly becomes popular you're better prepared.

Improve this answer
4
  • My site performs very well. Me holding the refresh button does no damage to it, I was just stating that my current script blocks me after about 50 requests, but I want it to perm block. And HTTP traffic cannot be spoofed. I know that for a fact. I need better help than what you gave.
    – Jerry Longhorn
    Dec 3, 2014 at 7:01
  • Your IpTables rules count these packets: tcp, port 80, starting a new connection. End. No matter if those packets are for a HTTP or whatever else connection type. No matter if the answer (SYN-ACK) goes to the moon, packets are counted, source will be blocked. Fail2ban acts on the result of log files, which means that an application successfully handled a request (successful tcp 3-way handschake). That’s why I think this answer from @devicenull is a correct one according to your problem description.
    – Zimmi
    Dec 3, 2014 at 10:08
  • If you really want to permanently block: instead of DROP, send to a new chain that stores the source in a new recent list, and match against that new list to block. But you’ve been informed. You could also read the IpTables manual and check the option --update instead of --rcheck.
    – Zimmi
    Dec 3, 2014 at 10:08
  • I was using --update previously. I also read the help docs on --update and --rcheck, I couldn't really figure out too many differences. I tried them both, nothing different from what I saw. Anyways, making a new chain... Let me read the manual on how to do this accurately.
    – Jerry Longhorn
    Dec 3, 2014 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .