1

It looks like a penetration test is running against a web-application deployed on my centOS7 server. How can I block incoming requests on port 80 and 443, coming from the source IP address 11.21.32.44

I would block it using the OS firewall, centOS7 use firewalld

Reading from fedora documentation the rule should be something similar to this:

firewall-cmd --add-rich-rule="
  rule family='ipv4'
  source address='11.21.32.44'
  port protocol='tcp' port='443' reject"

Ok, now thinking better, I would like to find a way to automatically block specific IP address after N requests with 404 httpd response

2

1 Answer 1

0

If it's some bot it should be safe to reject all its connection attempts (regardless of the destination port).

For that it's sufficient to add it's IP-address or range to the firewalld block zone:

firewall-cmd --zone=block --add-source=203.0.113.208/29

You might determine the range by querying one logged address via whois $someip and using ipcalc -d or some database of well-known unwanted bots.

Of course, adding single addresses is also possible.

You may want to add --permanent to persist those blockings.


Note that firewalld just rejects new connections, not established ones, such that an established connection to your web-server might still fill your logs.

To also get rid of those you can kill them with ss:

ss -K dst 203.0.113.208

(yes, you have to use dst for the source address of the bot)


Automating this is tricky because there are several risks involved:

  • you increase your attack surface (this isn't a theoretical risk, you may want to search for past fail2ban CVEs and similar)
  • too many false-positives, i.e. your automatic system might over-block, i.e. blocking legitimate visitors/customers or even yourself
  • ...
1
  • If really want to block address+port tuples you can create an IPSet for that and use that (also using firewall-cmd). Feb 11, 2023 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .