9

I'd like to block ALL incoming traffic from Amazon AWS IPs.

They publish a list of their IP addresses in json format here: http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

I have a dedicated server running Ubuntu 14.04 LTS.

Is there a way to do this with iptables? Could the rules be grouped somehow so they could be replaced periodically without affecting non-related rules? Or perhaps there is some other, better way to approach this?

Thanks!

Improve this question
7
  • 1
    Why do you want to block all traffic from AWS?
    – bobmagoo
    Dec 21, 2014 at 6:58
  • 2
    @bobmagoo, I'm getting massive amounts of screen scraping traffic from AWS. None of my users have a legitimate reason to access my server from an AWS IP.
    – zulugrid
    Dec 21, 2014 at 13:32
  • 4
    Have you tried reporting the abusive IP's? portal.aws.amazon.com/gp/aws/html-forms-controller/contactus/…
    – bobmagoo
    Dec 21, 2014 at 16:57
  • 1
    Reporting abuse works great for heavy scrapers, but doesn't do anything for low-volume scrapers. I recognize that I can't stop scrapers altogether, but I can make things harder on them.
    – zulugrid
    Dec 22, 2014 at 17:10
  • 2
    Doesn't matter what their AUP says if they don't enforce it for low-volume offenders.
    – zulugrid
    Dec 26, 2014 at 17:02

3 Answers 3

Reset to default
14

I used the information provided by alienth to create a bash script to block all AWS traffic. You can get it on GitHub: https://github.com/corbanworks/aws-blocker

Improve this answer
6

You can create a new iptables chain which can be separately flushed and refreshed.

$ iptables -N AWS
$ iptables -I INPUT 1 -j AWS

From here, just add all of the IP ranges to the AWS chain. To refresh the rules, simply iptables -F AWS and re-populate. For example:

$ iptables -F AWS
$ iptables -A AWS -s 50.19.0.0/16 -j REJECT

If you want to automate this, one thing you'll have to figure out is how trustworthy the IP data provided by AWS is. When pulling the JSON file make sure that you validate the SSL cert properly. There is still a possibility that AWS could release a malformed file, resulting in an automated iptables script blocking things you don't want to block.

Improve this answer
-1

I downloaded the most recent list of AWS IPs as of 8/21/2019 and cleaned it up so you can just copy and paste it into any IP deny list or table: https://textuploader.com/1t5o0

Hate AWS, nothing but trolls and bots originating from them, no normal person surfing the net would be using their IPs. I get around 8,000 hits/day on my site and as soon as I added this list to my WHM Firewall Deny my server/site stopped getting waves of bad traffic and server spikes that slowed down my site, not a coincidence.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .