[Howto] Block HTTP flood with IPTables
Apart from scripts like BARF, that we discussed in our article about how to mitigate DDoS attacks, we can also use IPTables directly to block certain requests on layer 4 already. However, this is only possible if the bad requests always contain a certain string that no other requests contain (such as request URI, referrer, user agent). Sometimes that is the case and the most effcient solution would be to drop these requests before they even reach your web server or any other application, right? Now let's take this POST flood for example, which represents a real case scenario of a server which is attacked by a Pushdo botnet. In our Apache access logs we see lots of these requests that kill our Apache: 1.2.3.4 - [02/Dec/2013:14:54:40 +0100] "POST /?ptrxcz_9JIkQz8jIZ12hHs8Qks7j HTTP/1.1" 200 All of these requests contain the pattern "ptrxcz" which is not a legit URI and we don't see any legit requests containing that pattern. Therefore it will be safe to simply block every packet that contains the pattern... Continue
