Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, however is there a way using iptables I can detect IPs who're making excessive requests, and drop their connections to avoid overloading my web server ? Or is there a better solution to filter these packets all the same while not negatively affecting legitimate clients.

I'm using apache, on ubuntu 12.04.

  • Search terms for this would be: rate limit http requests per ip address – Brian Mar 19 '15 at 22:25

Because HTTP is TCP and TCP requires bi-directional communication, the source addresses of the attacks are actually the attack sources.

Since the sources are known and not spoofed, you can rate-limit in iptables to greatly reduce the request volume per source.

If there are too many sources to get the load manageable that way, you will need to find something about the requests to be able to classify them as droppable, then have your web server drop them. Ideas:

  • Requests all for the same specific resource?
  • Irregular headers (are they not requesting compression? sending HTTP/1.0? sending no cookies when normal users would)
  • Same or predictable user agent?
  • So could i filter by volume? Such as saying 1 IP is making like 100 requests for the same page per second? If so how would i do this? I'm not hugely experienced with IPTables. – user3407675 Mar 19 '15 at 22:28
  • Right - in iptables it's by packets and not requests, but yeah - something like this is what you'll want, setting it up for TCP port 80 instead of ICMP. – Shane Madden Mar 19 '15 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.