Linux server blocking foreign IP access and simple anti-CC attack interception.

Block Foreign IP Access

Log in to the server remotely via ssh, run the following command to obtain domestic IP ranges, which will be saved as /root/china_ssr.txt

wget -q --timeout=60 -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' | awk -F\| '/CN\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /root/china_ssr.txt

Save the following script as /root/allcn.sh, and set executable permissions (command: chmod +x  allcn.sh)

mmode=$1
CNIP="/root/china_ssr.txt"
gen_iplist() {
        cat <<-EOF
                $(cat ${CNIP:=/dev/null} 2>/dev/null)
EOF
}
flush_r() {
iptables  -F ALLCNRULE 2>/dev/null
iptables -D INPUT -p tcp -j ALLCNRULE 2>/dev/null
iptables  -X ALLCNRULE 2>/dev/null
ipset -X allcn 2>/dev/null
}
mstart() {
ipset create allcn hash:net 2>/dev/null
ipset -! -R <<-EOF 
$(gen_iplist | sed -e "s/^/add allcn /")
EOF
iptables -N ALLCNRULE 
iptables -I INPUT -p tcp -j ALLCNRULE 
iptables -A ALLCNRULE -s 127.0.0.0/8 -j RETURN
iptables -A ALLCNRULE -s 169.254.0.0/16 -j RETURN
iptables -A ALLCNRULE -s 224.0.0.0/4 -j RETURN
iptables -A ALLCNRULE -s 255.255.255.255 -j RETURN
iptables -A ALLCNRULE -m set --match-set allcn  src -j RETURN 
iptables -A ALLCNRULE -p tcp -j DROP 
}
if [ "$mmode" == "stop" ] ;then
flush_r
exit 0
fi
flush_r
sleep 1
mstart

Run the following command to start blocking

/root/allcn.sh

Run the following command to stop blocking

/root/allcn.sh stop

CC Attack Blocking

Method 1:Use the netstat -an command to count IPs with current request concurrency greater than 100, then automatically add IPs not in the whitelist to the DROP rule

First run

vi  deny_1.sh

Add the following command statements

#!/bin/bash
if [[ -z $1 ]];then
        num=100
else
        num=$1
fi
cd $(cd $(dirname $BASH_SOURCE) && pwd)
iplist=`netstat -an |grep ^tcp.*:80|egrep -v 'LISTEN|127.0.0.1'|awk -F"[ ]+|[:]" '{print $6}'|sort|uniq -c|sort -rn|awk -v str=$num '{if ($1>str){print $2} fi}'`
if [[ ! -z $iplist ]];
then
        for black_ip in $iplist
            do                	
                ip_section=`echo $black_ip | awk -F"." '{print $1"."$2"."$3}'`                
                grep -q $ip_section ./white_ip.txt
                if [[ $? -eq 0 ]];then                        
                        echo $black_ip >>./recheck_ip.txt
                else                        
                        iptables -nL | grep $black_ip || iptables -I INPUT -s $black_ip -j DROP
                        echo $black_ip >>./black_ip.txt
                fi
           done
fi

After saving, run the following statements:

chmod +x deny_1.sh
sh deny_1.sh

Blocked IPs will be recorded in black_ip.txt. If there are whitelist IPs to exclude, you can add these IPs to white_ip.txt, one per line.

Method 2:Use attacker access characteristics in the web server logs, filter out the attacking IPs based on these characteristics, and use iptables to block them (excluding local IP: 127.0.0.1).

First run

vi deny_2.sh

Add the following command statements:

#!/bin/bash  
OLD_IFS=$IFS  
IFS=$'\n'  
for status in `cat website_access_log_path | grep 'feature_string' | grep -v '127.0.0.1' | awk '{print $1}' |sort -n | uniq -c | sort -n -r | head -20`  
do  
  IFS=$OLD_IFS  
  NUM=`echo $status | awk '{print $1}'`  
  IP=`echo $status | awk '{print $2}'`  
    if [ -z "`iptables -nvL | grep "dpt:80" | awk '{print $8}' | grep "$IP"`" ];then  
    if [ $NUM -gt 250 ];then  
      /sbin/iptables -I INPUT -p tcp  -s $IP --dport 80 -j DROP  
    fi  
  fi  
done

After saving, run the following statements:

chmod +x deny_2.sh
sh deny_2.sh

Finally, use crontab -e to add it to the scheduled tasks, to run once every 20 minutes:

*/20 * * * * /root/deny_ip1.sh  >dev/null 2>&1

Note:

1. For those using Baidu Cloud Acceleration or other CDN acceleration, the visitor IP may be a CDN node IP, so this method is not applicable for blocking.

2. For Method 1, if an IP in the same subnet as the whitelist appears in the high-concurrency list, it will not be blacklisted directly; instead, it will be written to recheck_ip.txt.
   

3. For Method 2, before execution, it is recommended to first rename the original log file, and use the newly generated log file as the basis.

4. It is not recommended to block for a long time. After a period of time, once the server load is normal and the attack has basically stopped, cancel the blocking in time and restore the original state.