How do you use iptables to prevent hundreds of pages from being accessed from the same IP address within a minute?
Is there a way to prevent 100 websites from being accessed from the same IP address, in order to prevent or at least limit an attack from that IP address? The attacker attempts to access one or more domain names, usually one, using 100 different MYSQL injection attacks.
How to limit the number of simultaneous calls to the same IP?
https://www.cyberciti.biz/faq/iptables-connection-limits-howto/
alternatively also via fail2ban after more targeted rules
No failtoban runs here from the beginning, but it looks into the logfiles SPÄTER!! 500 attempts have already been made.
then you have configured something wrong, send out the log
fail2ban cannot prevent requests.
you can also create a rule after 10 typical sql injection requests, but also only with get requests. Otherwise, snort would possibly still be interesting for you to protect entire networks, either as men-in-the-midde operated or as a command geber. As soon as you know the keys, there can also be a deep-packet analysis for the network behind it and so attacked filter out. Of course, it is much more complex.
No, that’s nothing wrong to do… fail2ban passes through the log files and blocks the IPs due to its own rules depending on the call…
But until then the attack has already taken place. Yes fail2ban locks the IP correctly, but only after the attacker has called the websites 300 times within 1 minute. After that it may not happen, but 299 attacks might have been successful
Such DDOS attacks can only be done by interposed proxies such as them e.g. B. Cloud flare offer, prevent.
You yourself? Not yet:-(
Alex
This must go as root and owner of the Strato root server
No. The can without proxy and load balancing do not go.
You log in to Cloudflare, then requests are filtered to your server and only the requests are passed through to your server that are not DOS attacks.
And how do you do that?