How can I lessen the impact of bandwidth attacks with IPTables or APF?

seisatsu · 04-26-2011, 08:06 PM

My server has been the repeated victim of bandwidth attacks: any large file on the server is downloaded repeatedly, with the goal of pushing the server over the provider's bandwidth limit.

How can I lessen the effect of these kinds of attacks with IPTables or APF? For example, can I set the server to:

Code:

Block V IP that downloads W file over X size more than Y times per Z time.

Or something similar? Is this possible? Is there a more effective way, and can a firewall even do this? My web server is Lighttpd, perhaps I can place such a rule directly in its config?

EricTRA · 04-27-2011, 01:51 AM

Hello and Welcome to LinuxQuestions,

Here's a script I found on the internet a while ago (sorry don't remember the link so cannot give credit where credit is due). This script limits the number of connections from the same IP. You can easily adapt it to your needs if you have some Bash experience. Hope it helps.

Code:

#! /bin/bash

while [ 1 ] ;
do
	for ip in `lsof -ni | grep httpd | grep -iv listen | awk '{print $8}' | cut -d : -f 2 | sort | uniq | sed s/"http->"//` ;
	# the line above gets the list of all connections and connection attempts, and produces a list of uniq IPs
	# and iterates through the list
	do
    		noconns=`lsof -ni | grep $ip | wc -l`;
    		# This finds how many connections there are from this particular IP address
    		echo $ip : $noconns ;
    		if [ "$noconns" -gt "10" ] ;
    		# if there are more than 10 connections established or connecting from this IP
    		then
			# echo More;
      			# echo `date` "$ip has $noconns connections.  Total connections to prod spider:  `lsof -ni | grep httpd | grep -iv listen | wc -l`" >>/var/log/Ddos/Ddos.log
      			# to keep track of the IPs uncomment the above two lines and make sure you can write to the appropriate place
      			iptables -I INPUT -s $ip -p tcp -j REJECT --reject-with tcp-reset
      			# for these connections, add an iptables statement to send resets on any packets recieved
    		else
        		# echo Less;
    		fi;
  	done
sleep 60
done

Kind regards,

Eric