7

I'd like to block ALL incoming traffic from Amazon AWS IPs.

They publish a list of their IP addresses in json format here: http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

I have a dedicated server running Ubuntu 14.04 LTS.

Is there a way to do this with iptables? Could the rules be grouped somehow so they could be replaced periodically without affecting non-related rules? Or perhaps there is some other, better way to approach this?

Thanks!

7
  • 1
    Why do you want to block all traffic from AWS? – bobmagoo Dec 21 '14 at 6:58
  • 2
    @bobmagoo, I'm getting massive amounts of screen scraping traffic from AWS. None of my users have a legitimate reason to access my server from an AWS IP. – zulugrid Dec 21 '14 at 13:32
  • 4
    Have you tried reporting the abusive IP's? portal.aws.amazon.com/gp/aws/html-forms-controller/contactus/… – bobmagoo Dec 21 '14 at 16:57
  • 1
    Reporting abuse works great for heavy scrapers, but doesn't do anything for low-volume scrapers. I recognize that I can't stop scrapers altogether, but I can make things harder on them. – zulugrid Dec 22 '14 at 17:10
  • 1
    It's still against their AUP, the volume of the badness doesn't factor in to that. – bobmagoo Dec 25 '14 at 16:14
11

I used the information provided by alienth to create a bash script to block all AWS traffic. You can get it on GitHub: https://github.com/corbanworks/aws-blocker

6

You can create a new iptables chain which can be separately flushed and refreshed.

$ iptables -N AWS
$ iptables -I INPUT 1 -j AWS

From here, just add all of the IP ranges to the AWS chain. To refresh the rules, simply iptables -F AWS and re-populate. For example:

$ iptables -F AWS
$ iptables -A AWS -s 50.19.0.0/16 -j REJECT

If you want to automate this, one thing you'll have to figure out is how trustworthy the IP data provided by AWS is. When pulling the JSON file make sure that you validate the SSL cert properly. There is still a possibility that AWS could release a malformed file, resulting in an automated iptables script blocking things you don't want to block.

-2

I downloaded the most recent list of AWS IPs as of 8/21/2019 and cleaned it up so you can just copy and paste it into any IP deny list or table: https://textuploader.com/1t5o0

Hate AWS, nothing but trolls and bots originating from them, no normal person surfing the net would be using their IPs. I get around 8,000 hits/day on my site and as soon as I added this list to my WHM Firewall Deny my server/site stopped getting waves of bad traffic and server spikes that slowed down my site, not a coincidence.

Not the answer you're looking for? Browse other questions tagged or ask your own question.