How do you use iptables to prevent hundreds of pages from being accessed from the same IP address within a minute?

Is there a way to prevent 100 websites from being accessed from the same IP address, in order to prevent or at least limit an attack from that IP address? The attacker attempts to access one or more domain names, usually one, using 100 different MYSQL injection attacks.
How to limit the number of simultaneous calls to the same IP?

(1 votes)
Loading...

Similar Posts

Subscribe
Notify of
11 Answers
Oldest
Newest Most Voted
Inline Feedbacks
View all comments
geheim007b
3 months ago

https://www.cyberciti.biz/faq/iptables-connection-limits-howto/

alternatively also via fail2ban after more targeted rules

slaxxer
3 months ago
Reply to  saunatom

then you have configured something wrong, send out the log

EinAlexander
3 months ago
Reply to  geheim007b

alternatively also via fail2ban after more targeted rules

fail2ban cannot prevent requests.

geheim007b
3 months ago

you can also create a rule after 10 typical sql injection requests, but also only with get requests. Otherwise, snort would possibly still be interesting for you to protect entire networks, either as men-in-the-midde operated or as a command geber. As soon as you know the keys, there can also be a deep-packet analysis for the network behind it and so attacked filter out. Of course, it is much more complex.

EinAlexander
3 months ago

How to prevent iptables from calling hundreds of pages within a minute from the same IP?

Such DDOS attacks can only be done by interposed proxies such as them e.g. B. Cloud flare offer, prevent.

How to prevent the number of simultaneous calls of the same IP?

You yourself? Not yet:-(

Alex

EinAlexander
3 months ago
Reply to  saunatom

This must go as root and owner of the Strato root server

No. The can without proxy and load balancing do not go.

EinAlexander
3 months ago

And how do you do that?

You log in to Cloudflare, then requests are filtered to your server and only the requests are passed through to your server that are not DOS attacks.