My server occasionally get massively hit by (probably bots) on a small group of IPs. Is there a good way (probably in iptables) to slow down or temporarily block/tarpit connections coming from an IP that has connected many times recently?


Yes, iptables supports this kind of dynamic rate limiting.

See here for details: http://codingfreak.blogspot.com/2010/01/iptables-rate-limit-incoming.html

  • Hmm... it seems that I cannot set a --hitcount over 20... that's not very useful in this case. Is there a way around that? – singpolyma Dec 20 '11 at 16:09

Maybe denyhosts would be a useful tool for you.

  • I'm using denyhosts already for ssh traffic, yes :) – singpolyma Dec 20 '11 at 16:08
  • Denyhosts needs an auth log to read... These are not failures of any kind, just DNS queries. – adaptr Dec 20 '11 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.