Search code examples
securityapache2ddosdenial-of-servicefail2ban

Trigger fail2ban for IPs with a lot of simultaneous connections

we are having a server with much traffic. Since yesterday, we are being attacked (probably) by an automated botnet, where IPs are opening thousands of simultaneous connections at the same time. That's really drowning resources and we tried something with fail2ban to prevent this, but no success yet.

I hope you can help!

We are running on a Debian 9.8 with apache2 and fail2ban.

An example of an attacking IP

Solution

  • This all depends on what your /etc/fail2ban/jail.local looks like.

    It should be setup to block that IP after 3 attempts. For example:

    # "bantime" is the number of seconds that a host is banned.
bantime  = 6000
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 60
maxretry = 3

    Note, the above denotes, if an attempt is made 3 times in 60seconds, then "ban" add to jail for 100minutes.

    bantime = -1

    A bantime of -1 means a Permanent ban.