1

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP addresses using iptables. But I still see the logs of the requests coming from these IP addresses in Apache.

the commands I used:

iptables -A INPUT -s 185.62.189.92 -j DROP
iptables -A OUTPUT -d 185.62.189.92 -j DROP

here is my iptables:

# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 5146 packets, 553K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       all  --  *      *       185.62.189.98        0.0.0.0/0           
2        0     0 DROP       all  --  *      *       185.62.189.91        0.0.0.0/0           
3        0     0 DROP       all  --  *      *       185.62.189.92        0.0.0.0/0           
4        0     0 DROP       all  --  *      *       5.196.18.195         0.0.0.0/0           
5        0     0 DROP       all  --  *      *       185.62.188.98        0.0.0.0/0           
6        0     0 DROP       all  --  *      *       185.11.144.82        0.0.0.0/0           
7        0     0 DROP       all  --  *      *       185.11.144.82        0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 6497 packets, 7556K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       all  --  *      *       0.0.0.0/0            185.62.189.98       
2        0     0 DROP       all  --  *      *       0.0.0.0/0            185.62.189.91       
3        0     0 DROP       all  --  *      *       0.0.0.0/0            185.62.189.92       
4        0     0 DROP       all  --  *      *       0.0.0.0/0            5.196.18.195        
5        0     0 DROP       all  --  *      *       0.0.0.0/0            185.62.188.98       
6        0     0 DROP       all  --  *      *       0.0.0.0/0            185.11.144.82       
7        0     0 DROP       all  --  *      *       0.0.0.0/0            185.11.144.82 

I still get tons of requests from the blocked addresses:

tail -f error.log
[Thu May 14 03:35:40.483899 2015] [authz_core:error] [pid 11474] [client 5.196.18.195:48105] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:40.920629 2015] [authz_core:error] [pid 11526] [client 185.62.189.92:17158] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:41.343127 2015] [authz_core:error] [pid 11526] [client 185.62.189.92:17158] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:41.830613 2015] [authz_core:error] [pid 11511] [client 185.62.189.92:46302] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:42.387676 2015] [authz_core:error] [pid 11501] [client 185.62.189.92:40100] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:43.362905 2015] [authz_core:error] [pid 11508] [client 185.62.189.92:16423] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:44.487948 2015] [authz_core:error] [pid 11501] [client 185.62.189.92:40100] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:46.066769 2015] [authz_core:error] [pid 11508] [client 185.62.189.92:16423] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:47.908027 2015] [authz_core:error] [pid 11527] [client 5.196.18.195:54456] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:47.938903 2015] [authz_core:error] [pid 11501] [client 5.196.18.195:9522] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:48.014147 2015] [authz_core:error] [pid 11487] [client 5.196.18.195:25948] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:48.118337 2015] [authz_core:error] [pid 11445] [client 185.62.189.92:23557] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:49.381834 2015] [authz_core:error] [pid 11510] [client 185.62.189.92:14750] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:51.074766 2015] [authz_core:error] [pid 11445] [client 185.62.189.92:23557] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:51.338875 2015] [authz_core:error] [pid 11487] [client 5.196.18.195:25948] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
[Thu May 14 03:35:51.602580 2015] [authz_core:error] [pid 11445] [client 185.62.189.92:23557] AH01630: client denied by server configuration: /var/www/html/xmlrpc.php
  • 1
    Is that the complete iptables output you're showing? It doesn't make sense since clearly the traffic is accepted as the log shows. – zagrimsan May 15 '15 at 11:55
  • BTW, if this is business environment (as it should be as you're in SF), the rule set is pretty scary - you're allowing everyone to any port on the server, so I really do hope you have had it hardened properly, and don't have any services open to the internet except those that are strictly necessary. – zagrimsan May 15 '15 at 11:58
  • yes, it's the complete output – mustafa May 15 '15 at 16:54
  • @zagrisman That's a very personnal opinion, but I think an empty ruleset on a server is perfectly fine in many cases. A private service should not be bound to a public interface anyway, users not allowed to communicate on the network should be denied ip socket creation altogether, and if network filtering is really required, it should be done on a dedicated device. – b0fh May 15 '15 at 22:33
  • @b0fh I agree on the case of a private service which is not accessible from the public network. It's also true that this kinds of attacks on enterprise settings probably should be dealt with in the perimeter. In this case that doesn't seem the case, though (or if there is a perimeter firewall, the OP should deal with the attack there). – zagrimsan May 18 '15 at 2:57
1

You can just deny the request for those ip's from the virtual host with a rewrite.

RewriteEngine On
RewriteCond %{REMOTE_ADDR} ^185\.62\.189\.92 [OR]
RewriteCond %{REMOTE_ADDR} ^186\.62\.189\.92 [OR]
RewriteRule ^(.*)$ - [F,L]
  • thanks, but I want to do it on a lower level with the firewall – mustafa May 14 '15 at 19:32
0

Try to add interface name in Your rules:

-i eth0 for INPUT rule
and
-o eth0 for OUTPUT rule.

To find Your own interface name You can with command:
ifconfig

  • Having the rule applied to all interfaces shouldn't render it non-functioning, though. – zagrimsan May 18 '15 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.