[SOLVED] iptables DOS protection

Habitual · 11-27-2015, 09:46 AM

This week was interesting. It seems every holiday, I get tons of GETs on my apache2 host from scripts/bots that aren't using a browser.
This Thanksgiving I got 1600 from one such User-Agent in 1 minute and some change.

Code:

54.174.59.53 - - [25/Nov/2015:18:56:37 -0800] "GET /robots.txt HTTP/1.1" 200 664 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36 HubSpot Webcrawler"
54.174.55.26 - - [25/Nov/2015:19:00:50 -0800] "GET /favicon.ico HTTP/1.1" 200 1683 "http://www.domain.com/contact-us/privacy" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36 HubSpot Webcrawler"

(since banned directly on 54.174.0.0/15 and using fail2ban's apache-badbots.conf).

I am considering the following:

Code:

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT

Do I want to Insert or Append into my current rules if I consistently put rules into my iptables using

Code:

iptables -I INPUT -s $i -j DROP

Thank you for your time.

Ser Olmy · 11-27-2015, 01:36 PM

iptables rules are parsed from the top downwards. -A will put the new rule at the very bottom of the chain, so if you want a DROP rule to take precedence over the existing ALLOW rule for port 80, you will need to use -I.

Habitual · 11-27-2015, 06:33 PM

Thanks Ser Olmy!

It's got an "edge" perimeter since it's up in AWS, so all I have are DROPs and

Code:

fail2ban-c9custom  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0           
Chain fail2ban-c9custom (1 references)
Chain fail2ban-ssh (1 references)

...
and 2

Code:

RETURN     all  --  0.0.0.0/0            0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

I'll save and test.

Thanks for your time.