Block IP, How To
May 16, 2007Can any one let me know how to block a range IP on SSH?
Eg: i'd like to block all IP: 67.63.123.xxx
ADVERTISEMENT
Way To Block IP
Jul 8, 2009I am curious, what is the best way to ban certain IP from accessing server? I have software firewall (APF) and there is, of course, /etc/hosts.deny.
Which is the most efficient? I've read that software firewall becomes unstable after so many entries. Does the same apply to /etc/hosts.deny file?
Or is there a better way altogether?
How To Block IP
Jun 8, 2009some Chinese forums hotlinking images from my site and I even delete those images they keep sending me huge amount of http requests to my hosting server and eating 800mb of memory and upto 1GB cause server crash
I tried to block incoming referrer traffic from those sites using htaccess but it didn't work , I still see their http request on my server logs and memory keep goes high , am not sure my code is the right
how can I block these http request from these domains , what is the right htaccess code , I use DirectAdmin panel by the way
How To Block A Block Of IP'S
Jan 9, 2007I'm currently experiencing a lot of IP's starting with 200 and 201 (from Brazil) some IP’s have over 200 connections. I have APF installed and want to know how to block a block on ip's if this is possible.
IPS:
200.11.*******
201.*******
How To Block All Other IP And Allow Certain IP Using APF
Apr 27, 2007I have DDos Attack right now so I want to block all the IP from all over the world and just allow certain IP range.
How to do it using APF or any other way.
For example I want to block everything but Germany IP
Code:
53.0.0.0/8
62.4.64.0/19
62.8.32.0/19
62.8.128.0/17
62.24.0.0/19
62.26.0.0/15
62.40.0.0/19
62.44.32.0/19
62.48.64.0/19
62.50.32.0/19
62.50.96.0/19
62.50.192.0/18
62.52.0.0/14
62.61.32.0/19
62.68.0.0/19
62.72.0.0/18
62.72.64.0/19
62.75.128.0/17
62.78.64.0/20
62.80.0.0/18
62.80.96.0/19
62.89.160.0/19
62.91.0.0/16
62.93.192.0/18
62.95.128.0/18
62.104.0.0/16
62.109.64.0/18
62.109.128.0/19
62.111.0.0/17
62.112.32.0/19
62.112.64.0/19
62.112.128.0/19
62.116.128.0/18
62.117.0.0/19
62.128.0.0/19
62.128.160.0/19
62.133.0.0/19
62.138.0.0/16
62.141.32.0/19
62.141.160.0/19
62.145.0.0/19
62.143.0.0/16
62.144.0.0/16
62.146.0.0/16
62.152.0.0/19
62.152.160.0/19
62.153.0.0/16
62.154.0.0/15
62.156.0.0/14
62.165.0.0/19
62.168.192.0/19
62.169.0.0/19
62.176.128.0/19
To Block IP
Apr 15, 2007how can i block to access to some IP?
for examaple scripts in my hosts can not access to some IPs i want
How To Tell Fortigate Not To Block My VPS IP
May 5, 2009Fortigate appliances blocking an IP that is not in RBLs I have a problem with the IP 66.187.108.157 of my VPS it seems to be blocked by Fortigate appliances, as you can see in this error message:
SMTP error from remote mail server after RCPT TO:[url] host mail.am.com.pe [200.62.221.107]: 554 5.7.1 This message has been
blocked because it is from a FortiGuard - AntiSpam black IP address.(connection black ip 66.187.108.157)
However I have searched in this URL [url]and it is clean.
Any ideas on how to have/force Fortigate databases to become updated.
Block Spam
May 12, 2009I'm having difficulties with a whm running on centos dedicated server. The problem is that we receive too much of spam and junk emails. by too much I mean 2000 bulks per week. It's killing us.
how I can stop it.
How To Block The World
Jul 4, 2009IM about tired of spam and hackers putting phishing items on my server.
My question is.
How can I block the whole world expect for US, CA and UK?
I've added several countrys to csf's csf.deny list but half of them keep disappearing.
Block A Specific ISP
Jun 12, 2008Is there any way to block a particular ISP? Have a visitor that changes IP hourly, but the IP always resolves back to a hostname like dsl.yuns.sksk.uk .
I have CSF installed. Any way to block all visitors from dsl.yuns.sksk.uk?
Suhosin Block
Jun 17, 2008in one of my servers i have this line in my ConfigServer Security & Firewall:
190.28.118.155 # lfd: 10 (suhosin) login failures from 190.28.118.155 - Mon Jun 16 23:27:50 2008
is this ok? i mean... its an attack of some sort? i know suhosin is meant to increase php security, so its blocking an attack right?
Apf To Block An IP Address
Apr 29, 2008I have blocked this IP 125.115.144.28
/etc/apf/apf -d 125.115.144.28
But
netstat -anp|grep tcp|awk '{print $5}'| cut -d : -f1 | sort | uniq -c | sort -n
It still showing
202 125.115.144.28
Why?
Is it supposed to blocked right away, or need some time to get blocked.
When I checked /etc/apf/deny_hosts.rules
The IP is in the file.
Block An IP Range ...
Apr 6, 2008I set up a forum for a small group of users, so I don't really wish to see spiders or bots on it, so I've put a robots.txt file there to prevent all of them from accessing the forum pages.
I know not all bots follow the robots.txt rule, and these days a really annoying bot called MUNAXNET or Munax AB with IP range 82.99.30.0 - 82.99.30.127 is causing the forum to have extra and unexpected loads.
I've tried to block this IP range with .htaccess and uploaded it to the root of the site a few days ago, here is the content:
<Limit GET HEAD POST>
order allow,deny
deny from 82.99.30.0-82.99.30.127
allow from all
</LIMIT>
However strangely it seems that all of these are not working for this bot, today I saw my forum had 80 users online and that army still keeps coming and browsing all pages of my forums...
I tested the .htaccess with blocking myself, and it actually worked for me, dunno why it's not working for that bot..
Should I Block Yandex
Mar 13, 2008I was just researching my log analyzers to see whats happening... I noticed something new in the logs, a large number of unnamed robots or spiders... so I found the robot... it was this:
23310 7.99% 23303 9.48% 1159765 18.56% 22 0.12% 77.88.26.26
After some reading, sites say the ip belongs to spider26.yandex.ru
For simply security reasons, would it be in best interest to block the entire subnet? It seems that the same IP ending in .25 belongs to spider25.yandex.ru
Anyone Using Snort - Does It Really Block Anything
Apr 25, 2008Is anyone using snort?
Does it really block any web based attacks?
I know I can do port scans, and it can alert you to a whole bunch of false positvies, but is it blocking/detecting any serious attacks on your web server?
If so, which rules are the one is alerting on?
Block A Bot By Netmask
Jan 8, 2008I have a Juniper firewall. I'm seeing a ton of traffic from the Twiceler bot in the range of 100,000 hits a day. Luckily they've more recently put up a list of IP addresses their bots use at:
[url]
So, I'm blocking all of these now. However I think it's a simple Netmask issue I'm having. I'm blocking all ports from
208.36.144.0/24
38.99.13.0/24
38.99.44.0/24
64.1.215.0/24
However, I am still seeing the bot in server log files. Could it be that I should not be specifying .0 at the end, but instead .1? Like this in the policy?
64.1.215.1/24
Block Spam
Jun 16, 2008I have spamassassin configured its working 90% but still I am receiving mails from my ID only. Like I have info@domain.com so I am receiving mail from info@domain.com to info@domain.com.
View 7 Replies View RelatedBlock Proxy
Feb 21, 2007How do I block known proxy sites such as anonymouse.org or such via CSF (firewall)? I'll need to block by domains, wildcard domains (such as *proxy.tld) and IP's.
What is the proper way and is there a nice list of such proxies? I'm trying to prevent some degenerate troll from accessing my forum.
How To Block Certain Referrals
Apr 22, 2008Since yesterday I have noticed some odd activity at one of my websites - www.cartuningcentral.com
The problem is that I am getting huge traffic from what I would say are traffic exchange programs, which I didn't buy, and don't want to have at all.
Examples of the referrals I am getting are:
[url]
[url]
Full details can be found here:
[url]
Now, I have tried to block all those using .htaccess, but I am by no means an expert on that.
Here's what I have done:
RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} ^(http://)?67.192.42.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} (tserve) [NC,OR]
RewriteCond %{HTTP_REFERER} (trafficserver) [NC,OR]
RewriteCond %{HTTP_REFERER} (67.192.42.2) [NC,OR]
RewriteCond %{HTTP_REFERER} (67.192.42.5) [NC]
RewriteRule .* - [F]
But it's not working at all.
how to block those referrals please?
It can be either using .htaccess, php, whatever.
BFD Events Before Block
Feb 12, 2007I Have APF and BFD Installed but it always seems to show 80 odd events before blocking the IP. Is there a way of setting it to say 10 wrong attempts?
I Tried this, but it hasn't done a thing. below happened after the change.
Quote:
REQ="/usr/sbin/sshd"
if [ -f "$REQ" ]; then
LP="/var/log/secure"
TLOG_TF="sshd"
TRIG="10"
Quote:
Originally Posted by From BFD E-mail
The remote system 205.234.140.219 was found to have exceeded acceptable login failures on URL; there was 83 events to the service sshd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.
Executed ban command:
/etc/apf/apf -d 205.234.140.219 {bfd.sshd}
The following are event logs from 205.234.140.219 on service sshd (all time stamps are GMT -0600):
Feb 12 09:08:32 serverthree sshd[4552]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35549 ssh2 Feb 12 09:08:32 serverthree sshd[4552]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:33 serverthree sshd[4555]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:35 serverthree sshd[4553]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35745 ssh2 Feb 12 09:08:35 serverthree sshd[4554]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35745 ssh2 Feb 12 09:08:35 serverthree sshd[4554]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:35 serverthree sshd[4557]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:35 serverthree sshd[4555]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35794 ssh2 Feb 12 09:08:35 serverthree sshd[4556]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35794 ssh2 Feb 12 09:08:35 serverthree sshd[4556]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:36 serverthree sshd[4559]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:37 serverthree sshd[4557]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35978 ssh2 Feb 12 09:08:37 serverthree sshd[4558]: Failed password for invalid user test from ::ffff:205.234.140.219 port 35978 ssh2 Feb 12 09:08:37 serverthree sshd[4558]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:08:38 serverthree sshd[4561]: Invalid user test from ::ffff:205.234.140.219 Feb 12 03:08:38 serverthree sshd[4559]: Failed password for invalid user test from ::ffff:205.234.140.219 port 36033 ssh2 Feb 12 09:08:38 serverthree sshd[4560]:
[snipped irrelevant and lengthy log file - gbjbaanb]
Failed password for invalid user testing from ::ffff:205.234.140.219 port 42990 ssh2 Feb 12 09:10:00 serverthree sshd[4679]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye Feb 12 03:10:01 serverthree sshd[4682]: Invalid user testing from ::ffff:205.234.140.219 Feb 12 03:10:02 serverthree sshd[4680]: Failed password for invalid user testing from ::ffff:205.234.140.219 port 43145 ssh2 Feb 12 09:10:02 serverthree sshd[4681]: Failed password for invalid user testing from ::ffff:205.234.140.219 port 43145 ssh2 Feb 12 09:10:02 serverthree sshd[4681]: Received disconnect from ::ffff:205.234.140.219: 11: Bye Bye
----
Block TOR Network
Apr 17, 2007I am seeing quite a few hacking attempts coming from the TOR network. I'd like to block the TOR network on the firewall level. Anyone know how to block them?
There is a python script, but I am not familiar with Python at all and do not know how run this script. It is supposed to extract all current IP Addresses and provide a list.
I think they have about 450 IP addresses and I would like to block them.
Adding IP Block To APF
May 9, 2007I currently have a private server in my office which has cPanel and APF installed. The server only allows one static IP to access SSH, at the moment I'm away and don’t have a static IP on my current ISP connection so cannot access SSH.
Is there a way to add say 123.456.000.000 which would allow all IP's in the 123.456 block?
Hackers And Know Bad IPs To Block.
May 23, 2007What would you think about creating a big text file with IPs of known hackers, bots and similar "bad" creatures to keep out from our servers? Do you think it's worth it?
You can post lists of IPs if you want...
APF Can't Block Banned One Of The IP
Nov 30, 2007Since some days I have a problem with apf: It can't BAN one of the Ip from file deny_hosts.rules. Other IP's are correctly banned. Of course in apf log are:
apf(28474): {trust} deny all to/from 88.84.141.233
but this ip still have access to my server and scan my ports. I have this problem after editing internals/rab.ports (I added some ports to RAB_PSCAN_LEVEL_2). I don't know how can I fix this problem.
Topic should have title: APF can't block one of the banned IP.
Class C IP Block / ASN
Oct 16, 2007I was told by my colocation provider that in order to get a Class C block through them we would have to upgrade to a full rack or get an ASN. At this time, we don't need the full rack space so I guess I have to go the ASN route (no pun intended).
I'm wondering how easy it is to get an AS number and about how long it would take. I did some research on the apnic site and it looks like the cost is $625 per year for just the AS numbers. Is this correct or is there anything else that we may need.
Purchasing An Ip Block
Nov 12, 2007Are there any sites that sell portable ip address blocks like this [url], but for the united states? I can't really read that site, but it looks like for 150 euros a month you can get a 256 portable IP address block. 89.36.148.0/23 seems to be a block purchased from them [url], then routed to AWKnet.
View 14 Replies View RelatedBlock Rapidleech Script?
Jul 29, 2009As most hosting company owners know, rapidleech is a very bad script which causes high CPU loads and abuses the server a lot. I do get a lot of abusive users like this on my shared hosting server, running the rapidleech script and abusing the server so much. I have to terminate, at least a few people a day. This is getting to be really annoying.
Is there anyway to block the rapidleech script for a cPanel/WHM server?
I've read that you can do this using Mod Security, but what do I put in my mod security configuration to block it?
Rapidleech is a script that allows anyone to upload the script to a server to download via rapidshare/megaupload to the server, which uses lots of hard drive, CPU, and RAM.
How To Block Countries Via Firewall?
Jun 1, 2007I was wondering we use ConfigServer Security & Firewall for our firewall and was wondering how we can go about blocking certain countries from being able to access our servers, mainly Korea, China and Russia?
I found this site: ....
Htaccess Block Spammers
Mar 13, 2007On my domain access logs, I see a spammer using many different IPs to join my top site list with fake emails. At the end of every line, it contains I am SPAMER! How can I configure htaccess to block this spammer when a request contains that text?
View 3 Replies View RelatedBlock A Range Of IP Addresses?
Feb 27, 2007Server: OS RHEL 4
Web Server: Apache1.3.37
Hi. I want to block a range of IPs. Currently, I use the following command as an effective weapon against the IPs of people I find in the log trying to do bad things.
/sbin/route add -host x.x.x.x reject
Works like a charm. I then put the offending IP in the file /etc/rc.d/rc.local so that it will reload the bad ips when the server reboots next.
I also use the CSF/LFD firewall, and it successfully blocks single, offensive IPs also.
What I need, though, is the ability to block an entire range of IPs. For example, i have a very persistent hacker trying to access from a certain range like so....
255.155.x.x.
The last two numbers are always changing but the first two remain the same.
How do I block this "range" of IPs from accessing my server?
Note, I know how to block a range of IPs in a .htaccess file for a certain account, I put this in the .htaccess file...
deny from 205.196.
But when I try this with /sbin/route, it will not accept the ip. My firewall will also not accept a range of IPs.
How To Block All And Allow Certain IP Addresses Range
May 7, 2007Is there any way to block all and just allow certain IP using APF or iptables?
I want to block all the traffic to the server and just alow IP range.