Blocking an IP from connecting
- by Sam W.
I have a problem with my Apache webserver where there's and IP than connecting to my server, using alot of connection and wont die which eventually making my webserver timeout. The connection will stay as SYN_SENT state if I check using
netstat -netapu
I even flush my iptables and use the basic rules and it still doesn't work. The IP will get connected when I start my Apache
Basic rules that I use:
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
iptables -A INPUT -s 89.149.244.117 -j REJECT
iptables -A OUTPUT -s 89.149.244.117 -j REJECT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
The bold part is rule in question.
Not sure this is related but tcp_syncookies value is 1.
Can someone point out my mistake? Is there a way to block it for good.
Thank you
