0

My server is blocking all IP addresses except Slovakia and Czech Republic, and I would like to log all other countries and then drop it.

So my rules looks like this:

iptables -A INPUT -m geoip ! --src-cc CZ,SK -j LOG_COUNTRY

then I have LOG_COUNTRY chain like this:

iptables -N LOG_COUNTRY
iptables -A LOG_COUNTRY -m limit --limit 5/s --limit-burst 10 -j LOG --log-prefix "COUNTRY DROP: "
iptables -A LOG_COUNTRY -j DROP

I would like to ask you how to "secure" it against DDoS, I set limit, so it should be fine.

But if someone will DDoS me, I would like to get all these IP addresses from DDoS attack, and I don't know if limit 5/s can log all attacker's IP addresses.

I don't know what limit number is considered as safe, I don't want to log same IP addresses and packets multime times per second, rather I would like to log as much different IP addresses as possible. I hope you understand me.

  • I don't think this config will help against a DDoS. I don't know if any confiig can help. I hope someone will prove me wrong. – Gerard H. Pille Apr 16 '18 at 12:27
  • It is not "against" DDoS, it is for logging all IP addresses of that DDoS. – tomsk Apr 16 '18 at 12:57
  • There's no guarantee that you will catch every single one of them, but if the attack goes on long enough, you'll have most of them. – Gerard H. Pille Apr 16 '18 at 13:01
  • It is that question if is possible to drop same packets and different packets log and then drop. And another subquestion is.. what limit number is safe, if 1000/s limit is overkill or so. I use SSD. – tomsk Apr 16 '18 at 13:05
  • 1
    Just freewheeling here. Wir schaffen dass! Don't block, but direct those requests to a tool that keeps a hash table of the IP addresses and logs every new one. Perhaps HaProxy with a sticky table? – Gerard H. Pille Apr 16 '18 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.