Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have website that identifies users only by their IPs. That makes it very difficult to keep it secure against unwanted users/attackers. They can simply change their IP by using VPN services that provides them numerous variety of IPs. So what I want is to not just blocking one IP but entire IPs under subnets of a VPN service, once attacker used one of them.

share|improve this question
    
I understand what you want. But do you have a specific question - such as how do I block the IP range for this/these IP address(es)? –  closetnoc May 2 at 15:50
    
Well, some of them here : 81.17.31.162, 81.17.31.164, 81.17.31.163, 84.200.68.66, 84.200.68.69 I can block like : 84.200.68.66/24, 81.17.31.164/24 But I dont want to bother to detect ip range every time. –  Kerem atam May 2 at 16:06
    
You cannot identify users by IP addresses. IP address is the address of a network interface, and there can be many users using the same IP address, and one user can have multiple IP addresses. On many mobile networks IP addresses change on every connection. So, you should try to use something else for user identification. –  Tero Kilkanen May 2 at 16:31

1 Answer 1

As it so happens, I was writing a script to allow people to enter an IP address notation and get an .htaccess regex to block the IP address and IP address block. Much of the code was borrowed from other places and the script has to be secured so it is not ready for prime-time. I scrambled to cobble the code together to try and help you.

If I got it right, the following will help.

RewriteCond %{REMOTE_ADDR} ^81.17.31.162$ [NC]
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} ^81.17.31.163$ [NC]
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} ^81.17.31.164$ [NC]
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} ^84.200.68.66$ [NC]
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} ^84.200.68.69$ [NC]
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} ^81.17.(0*[1-3]*[6-1]*).([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L]

RewriteCond %{REMOTE_ADDR} ^84.(2*0*[0-1]*).(0*[0-6]*[0-3]*).([0-2]*[0-5]*[0-5]*)$ [NC]
RewriteRule .* - [F,L]

Pay particular attention the the last two RewriteCond and test them to make sure I got it right. (I am fairly sure I did.) If they do not work, let me know and I will try again. They are intended to block the IP address blocks you provided according to the IP address assignments I have in my GEOAS database.

And yes! Before people begin to scream, there are better regex's for this- but this is the best I found for my automation work.

As far as I know there are no tools for automatically blocking IP address blocks. I could be wrong. You may want to check out Mod_Security for Apache/Windows which may do a lot for you automatically. It appears to amongst the best. There are other tools. I have not researched this recently so I won't try and comment.

Again, let me know if I got the regex right. I am creating an HTML form based tool for everyone who wants to block IP addresses and IP address blocks. This will help others.

BTW- I also agree that generally, you do not want to block whole IP address blocks. I do understand your concerns. I have automation that allows me to dynamically block IP addresses and follow abusers around my site and stop them cold. But this too is a work in progress and I am busy writing several patents that I will share later. I do this for the security research I am doing so I cannot give away the store just yet. Just know it will be showing up in various tools eventually.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.