-1

Here is the scenario:

I intend to protect my server from being queried with high frequency from the same IP, say, the upperbound is 60 times per minute.

I don't know how to do that via iptables, Is there any tools or bashes that can solve this problem? I'm really new to the security of Linux, and I need my server to be protected from being attack via robot program. Thanks a lot!

  • Read about rate limiting. – Iain Nov 25 '13 at 6:47
3

To limit hit rate from a specific IP using iptables you can do the following:

-A INPUT -p tcp --dport 80 -i eth0 -s 1.2.3.4 -m state --state NEW -m recent --set
-A INPUT -p tcp --dport 80 -i eth0 -s 1.2.3.4 -m state --state NEW -m recent --update --seconds 60 --hitcount 60 -j REJECT

This rejects packets from IP 1.2.3.4 if it hits port 80 on eth0 more than 60 times per 60 second period.

  • this is what I want, Thanks bro~ One more question, is it necessary to specify -i eth0 if I got multiple interfaces on my server? – Judking Nov 25 '13 at 8:19
  • You can omit -i eth0 to make the rule match all interfaces. The same goes for --dport 80 and -p tcp -- if you omit them the rule will match all ports and protocols. – Ketola Nov 25 '13 at 9:37
0

iptables will solve your problem. if it is a publicly open service, such as apache, you can rate limit.

if it is a private service that is being bombed, such as is commonly sshd (tcp/22), due to most distros having it open globally by default, then simply restrict access to it from only your ip. this goes for all private services, such as ftp for instance, not just sshd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.