Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the Apache config file) so they get a 403 response.

However, it's still an annoyance seeing them pop up in the Apache log file, and they also consume some resources.

Is it possible to drop the packets completely? Do I have to do this using iptables? What other ways are there to alleviate this issue?

share|improve this question
    
Why this question was migrated here? It belongs to ServerFault (iptables, routers, packets etc). –  LazyOne Aug 26 '11 at 9:16
    
Heck noes! silly stackers –  bybe Feb 12 '13 at 20:54
add comment

migrated from stackoverflow.com Aug 26 '11 at 8:16

This question came from our site for professional and enthusiast programmers.

2 Answers

If you want to deny them you need to see what signature you can identify them by. If you can identify something simple you can deny at router level you would ideally drop them at the external router, or choke router, before they get any further into your infrastructure - best bang for buck.

However it sounds like they are all very different, so you'll need something a little more intelligent to identify them.

What type of firewall do you have inboard of choke router? If it can do deep inspection and you can translate your Apache rules into something you can configure in your firewall you are again reducing the load on infrastructure further in towards the centre of your network.

iptables is unfortunately not very intelligent - it's more along the lines of your choke router, so to be honest, if you wanted to drop packets using iptables I would suggest dropping them at that router.

Final option - if you can only drop these requests in Apache, you could always configure it not to log these specific actions...I wouldn't recommend it though. It's usually best to have the data there so that if you need to analyse a change you can.

share|improve this answer
    
Possibly they can be logged in another file? –  Bart van Heukelom Aug 26 '11 at 12:29
add comment

Do I have to do this using iptables?

Using iptables is the best way to block traffic before it reaches Apache if you're certain that a particular address is malicious. If you're running Ubuntu, some people find that uncomplicated firewall (UFW) simplifies firewall configuration.

To block a known <IP address> using iptables:

sudo iptables -A INPUT -s <IP address> -j DROP

To block it using UFW:

sudo ufw deny from <IP address>

Linode has a useful guide to configuring iptables, and Ubuntu has an introduction to UFW that may prove useful.

What other ways are there to alleviate this issue?

You could set up a hardware firewall on a separate machine, which would act as a traffic cop, filtering traffic you deem unsafe and sending only permitted requests on to the server running Apache.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.