Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #265185

Re: Help: network abuse

Show all headers | View raw

On Thu, 21 Dec 2023, David Christensen wrote:

>
> Perhaps you could set up a DMZ, move services into the DMZ,  and provide a 
> VPN connection to the DMZ for your Internet users.  Then you could close all 
> of the incoming WAN ports except VPN.
>
>
> It might be possible to put the VPN endpoint into a VPS, create an SSH tunnel 
> out from the httpd server to the VPS, and close all of the WAN incoming 
> ports.
>

If the OP is worried about the bandwidth usage then none of that will
help. The fact that the OP is not sending a SYN+ACK (according to the
tcpdumps that I saw) means that this is already blackholed.[2]

There are three options at this point:
1. Ignore it - my "EVILSYN[1]" blacklist is right at the top of my iptables
rules and drops without logging before anything else.

2. Talk to their ISP and get it blocked there - that's the only surefire
way to stop it eating their quota if that's the problem.

3. Try and make them give up - that's why I suggested sending a RST.


[1] I have a set of rules that blacklist IPs that send too many SYN
packets that are not responded to with SYN+ACK.

[2] This did look weird. I'm not sure how only some connections get a
SYN+ACK back - I wonder if their webserver is rate-limited and these are
"genuine" connection attempts that are failing - although the SPT=80
DPT=80 looks suspiciously like something crafted to get through naive
stateless firewall rules that rely on outgoing (allowed) connections to
have DPT=80 to the internet and SPT=80 from the internet.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Help: network abuse Alain D D Williams <addw@phcomp.co.uk> - 2023-12-21 13:20 +0100
  Re: Help: network abuse Tim Woodall <debianuser@woodall.me.uk> - 2023-12-21 13:50 +0100
    Re: Help: network abuse <tomas@tuxteam.de> - 2023-12-21 16:00 +0100
    Re: Help: network abuse gene heskett <gheskett@shentel.net> - 2023-12-21 21:10 +0100
  Re: Help: network abuse Dan Purgert <dan@djph.net> - 2023-12-21 13:50 +0100
  Re: Help: network abuse Greg Wooledge <greg@wooledge.org> - 2023-12-21 14:00 +0100
    Re: Help: network abuse Alain D D Williams <addw@phcomp.co.uk> - 2023-12-21 14:20 +0100
      Re: Help: network abuse Andy Smith <andy@strugglers.net> - 2023-12-21 14:50 +0100
        Re: Help: network abuse Alain D D Williams <addw@phcomp.co.uk> - 2023-12-21 16:00 +0100
          Re: Help: network abuse Pocket <pocket@columbus.rr.com> - 2023-12-21 16:20 +0100
            Re: Help: network abuse Alain D D Williams <addw@phcomp.co.uk> - 2023-12-21 16:30 +0100
              Re: Help: network abuse Pocket <pocket@columbus.rr.com> - 2023-12-21 16:40 +0100
                Re: Help: network abuse Alain D D Williams <addw@phcomp.co.uk> - 2023-12-21 17:00 +0100
                Re: Help: network abuse Jeffrey Walton <noloader@gmail.com> - 2023-12-21 17:10 +0100
                Re: Help: network abuse Pocket <pocket@columbus.rr.com> - 2023-12-21 17:50 +0100
                Re: Help: network abuse Alain D D Williams <addw@phcomp.co.uk> - 2023-12-21 19:10 +0100
                Re: Help: network abuse Pocket <pocket@columbus.rr.com> - 2023-12-21 19:10 +0100
              Re: Help: network abuse debian-user@howorth.org.uk - 2023-12-21 19:20 +0100
            Re: Help: network abuse Peter Hillier-Brook <phb@hbsys.plus.com> - 2023-12-21 19:20 +0100
      Re: Help: network abuse Michel Verdier <mv524@free.fr> - 2023-12-21 15:50 +0100
  Re: Help: network abuse David Christensen <dpchrist@holgerdanske.com> - 2023-12-21 23:30 +0100
    Re: Help: network abuse Tim Woodall <debianuser@woodall.me.uk> - 2023-12-23 10:30 +0100
      Re: Help: network abuse David Christensen <dpchrist@holgerdanske.com> - 2023-12-23 20:00 +0100
        Re: Help: network abuse Tim Woodall <debianuser@woodall.me.uk> - 2023-12-23 23:00 +0100
          Re: Help: network abuse Pocket <pocket@columbus.rr.com> - 2023-12-23 23:30 +0100
        Re: Help: network abuse Dan Ritter <dsr@randomstring.org> - 2023-12-24 01:40 +0100
          Re: Help: network abuse David Christensen <dpchrist@holgerdanske.com> - 2023-12-24 04:00 +0100
        Re: Help: network abuse Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2023-12-24 07:20 +0100
          Re: Help: network abuse David Christensen <dpchrist@holgerdanske.com> - 2023-12-24 09:20 +0100

csiph-web