Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Date: Tue, 02 Feb 2016 00:04:02 +0000
From: Richard <lists-apache@listmail.innovate.net>
To: users@httpd.apache.org
Message-ID: <F2F8C07A26C4C7BA93D53DF0@ritz.innovate.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Subject: Re: [users@httpd] Re: throttling IP addresses

Are you referring to a 3rd-party firewall in front of the machine or
the OS's firewall. Most *nix system (built-in) firewalls that I've
dealt with have a lot of granularity and capabilities. They can
certainly do an IP-specific (or range) blocks on one (or all) ports
and some can do the throttling for you. That's what I've used when
I've needed to deal with issues like yours. Changing a web server
response to a 403 doesn't have all that much effect if you're
dealing with high-volume traffic.


> Date: Monday, February 01, 2016 22:07:45 +0100
> From: Luca Toscano <toscano.luca@gmail.com>
>
> Hi George,
>=20
> I would also check mod_qos for your use case!
>=20
> Luca
> Il 01 feb 2016 22:00, "George Genovezos"
> <George.Genovezos@copart.com> ha scritto:
>=20
>> Richard,
>>=20
>> I would agree with you that a more elegant solution is required.
>> Unfortunately the firewall will only block or allow a particular
>> port.
>>=20
>> The correct solution would be to implement an IPS solution in
>> front of a firewall, but where in the do more with less phase.
>>=20
>>=20
>> George Genovezos
>> Application Security Architect
>> CISSP, ISSAP, CIFI
>>=20
>> Copart
>> I--
>>=20
>> On 2/1/16, 2:27 PM, "Richard"
>> <lists-apache@listmail.innovate.net> wrote:
>>=20
>> >=20
>> >=20
>> >> Date: Monday, February 01, 2016 19:52:51 +0000
>> >> From: George Genovezos <George.Genovezos@Copart.Com>
>> >>=20
>> >> Hi,
>> >>=20
>> >> I=E2=80=99m hoping someone can help with a problem I=E2=80=99m =
having. I
>> >> need a basic Ddos  mitigation tool. Basically, either
>> >> throttling back certain IP addresses or blocking access after
>> >> too many connections per second.
>> >>=20
>> >> I know mod_evasive did this but the project, to my knowledge =
is
>> >> deprecated.
>> >>=20
>> >> So to draw this out, I want a web server to count the number =
of
>> >> connection per seconds, and if an IP breaches this limit to
>> >> either throttle or block the connection. Then I want to use
>> >> mod_proxy to reverse proxy that clean connection to my web
>> >> servers.
>> >>=20
>> >> Any feedback would be greatly appreciated.
>> >>=20
>> >> George Genovezos
>> >> Application Security Architect
>> >> CISSP, ISSAP, CIFI
>> >>=20
>> >> Copart
>> >=20
>> > In my view, doing this at the web server is rather late in the
>> > game. If I'm reading the mod_evasive documentation correctly,
>> > all it (or something similar) does is stops serving content and
>> > returns 403s. If your content is resource expensive to deliver
>> > that will help some, but you're still going to get all the
>> > requests hitting the web server and you're still going to be
>> > responding to them.
>> >=20
>> > The better place to address this is at your system's firewall.
>> > Depending on your system, you likely have firewall tools that
>> > can provide a more robust solution.
>> >=20
>> >=20
>> >=20
>> > ---------------------------------------------------------------
>> > ------ To unsubscribe, e-mail:
>> > users-unsubscribe@httpd.apache.org For additional commands,
>> > e-mail: users-help@httpd.apache.org
>> >=20
>>=20

------------ End Original Message ------------


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org