How to block connections to Apache if client doesn't have valid request headers?

Seregwethrin · 02-08-2011, 07:18 AM

Hi,

My server gets ddos attacks. I dig into access logs and I saw that attacker ips doesn't have valid requests headers, like their browser application info or requested url info.

I want to close those connections immediately, and if it's possible block those ips for a time period.

Can I do that with Apache and iptables?

I searched on the internet but couldn't find useful results. Probably couldn't search for the right words. If there are some pages or keywords to type please let me know.

Thanks

bathory · 02-08-2011, 08:29 AM

Hi,

You can use mod_rewrite to forbid access. For example to block a user-agent like "BAD-AGENT" and/or a GET request for phpmyadmin for example, you can use

Code:

RewriteEngine On

RewriteCond %{HTTP_USER_AGENT} "BAD-AGENT" [OR]
RewriteCond %{THE_REQUEST} ^GET\ /phpmyadmin
RewriteRule (.*) - [F]

Of course you can add more user-agent strings or request (like POST, CONNECT etc).

Now if you want to ban them for a time period you can use fail2ban

Regards

Seregwethrin · 02-08-2011, 12:21 PM

Well thanks, I've modified the apache mod_rewrite script and applied.
I'm still working on fail2ban
Thanks