Prevent Linux HTTP Server from outside attack.

nishith · 11-21-2011, 02:10 AM

Hello,

I am using "DenyHosts" to prevent Linux servers from "Brute Force" attack & I want to prevent Linux based "websites", which are running on "80" port. Reason is, if someone executes any script/program that will frequently (1000 times in a second) access website, then HTTP won't respond after few minutes & i have to restart the service.

Any Solution?

unSpawn · 11-21-2011, 05:08 AM

Limit new connections to 10 packets/sec and a maximum of 20 packets/sec per source IP address:

Code:

iptables -A INPUT -i eth0 -p tcp --dport 80 -m hashlimit --hashlimit 10/s --hashlimit-burst 20 --hashlimit-mode srcip,dstport --hashlimit-name INPUT -m state --state NEW -j ACCEPT