Home / server / Questions / 420051
Accepted
giorgio79
Asked: 2012-08-23 06:20:40 +0800 CST

Best way for automated ban / throttle of aggressive clients on a Linux / Apache webserver for a period of time?

  • 772

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best way to throttle /ban these for a few minutes / hours? Can CSF for example do sg like this? I am really looking for a quick and dirty solution.

web-server

1 Answers

  1. Best Answer

    Iptables could be used to that end.

    Blocking parallell connections:

    iptables -A INPUT -p tcp --syn --dport 80 -m connlimit \
     --connlimit-above 20 -j REJECT --reject-with tcp-reset

    Blocking floods (block more than 10 connections per minute) :

    iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent \
   --update --seconds 60 --hitcount 10 -j DROP
    • 2