New answers tagged


Given you have a very small set of IP addresses hitting your server I suggest you add deny rules on your public subnet Network Access Control List (NACL). It's in the EC2 console. If it were a DDOS then AWS Shield (free) would probably have taken care of it, and if not AWS WAF may also help.


Yes, you can do that, and a similar example is even in the nginx documentation. The access_log directive also takes an optional if= parameter which evaluates variables given to it, and logs only if the result is not 0 or an empty string. Combined with the fact that you can have more than one access_log in a level, you can log differently based on your needs. ...


It seems this was the better rule - stops the traffic before going over the GRE tunnel over the limit iptables -t mangle -A PREROUTING -p udp --dport 30000 -m set --match-set blacklist src -m hashlimit --hashlimit-mode srcip --hashlimit-srcmask 24 --hashlimit-above 100/sec --hashlimit-name test -j DROP -hashlimit-srcmask 24 - to group the incoming traffic ...

Top 50 recent answers are included