I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the Apache config file) so they get a 403 response.

However, it's still an annoyance seeing them pop up in the Apache log file, and they also consume some resources.

Is it possible to drop the packets completely? Do I have to do this using iptables? What other ways are there to alleviate this issue?

  • 1
    Why this question was migrated here? It belongs to ServerFault (iptables, routers, packets etc).
    – LazyOne
    Aug 26, 2011 at 9:16
  • Heck noes! silly stackers Feb 12, 2013 at 20:54

2 Answers 2


If you want to deny them you need to see what signature you can identify them by. If you can identify something simple you can deny at router level you would ideally drop them at the external router, or choke router, before they get any further into your infrastructure - best bang for buck.

However it sounds like they are all very different, so you'll need something a little more intelligent to identify them.

What type of firewall do you have inboard of choke router? If it can do deep inspection and you can translate your Apache rules into something you can configure in your firewall you are again reducing the load on infrastructure further in towards the centre of your network.

iptables is unfortunately not very intelligent - it's more along the lines of your choke router, so to be honest, if you wanted to drop packets using iptables I would suggest dropping them at that router.

Final option - if you can only drop these requests in Apache, you could always configure it not to log these specific actions...I wouldn't recommend it though. It's usually best to have the data there so that if you need to analyse a change you can.


Do I have to do this using iptables?

Using iptables is the best way to block traffic before it reaches Apache if you're certain that a particular address is malicious. If you're running Ubuntu, some people find that uncomplicated firewall (UFW) simplifies firewall configuration.

To block a known <IP address> using iptables:

sudo iptables -A INPUT -s <IP address> -j DROP

To block it using UFW:

sudo ufw deny from <IP address>

Linode has a useful guide to configuring iptables, and Ubuntu has an introduction to UFW that may prove useful.

What other ways are there to alleviate this issue?

You could set up a hardware firewall on a separate machine, which would act as a traffic cop, filtering traffic you deem unsafe and sending only permitted requests on to the server running Apache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.