1

I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want to block simple ping floods etc. on my server. How should I configure fail2ban to accommodate these different specs?

  • Fail2ban checks various log files for repeated login failures and bans the source IP addresses involved. That is the source of it's name - after a given number of failures move to banning. It can be extended to look for other events in logs but that is outside it's original intent. – Brian Mar 13 '14 at 18:15
  • Expanding on @Brian's comment, there's no reason why e.g. ping (ICMP echo request) floods would show up in your web server's logs, so you'd just configure fail2ban to look for (at) one but not the other. There's really nothing more to it than that. – a CVn Mar 13 '14 at 19:06
1

It'd be both easier and more efficient to rate limit ICMP with the firewall:

Linux:

iptables -I INPUT -p icmp --icmp-type echo-request -m recent --set 
iptables -I INPUT -p icmp --icmp-type echo-request -m recent --update --seconds 10 --hitcount 5 -j DROP

FreeBSD:

sysctl net.inet.icmp.icmplim=5

Windows:

Windows doesn't support rate limiting, only block/allow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.