Post by @jwz@mastodon.social

Earlier in this thread 1 post

@jwz@mastodon.social on mastodon.social

Nuclear option. I have a single AWS instance, with a static IP, not behind a load balancer or CloudFront. How do I block all of Hong Kong? I gather the answer has something to do with WAF but I don't understand. Please use small words, URLs, and assume that I have no idea what any of the acronyms you used mean. DO NOT answer questions I did not ask. https://jwz.org/b/yk9K

jwz @jwz@mastodon.social

· 3mo ago

Replying to

Conversation (13)

jwz

@jwz@mastodon.social ·Jul 12

fail2ban seems to be able to ban about 20 IPs/sec. That's not really gonna do the trick when I'm getting 200 reqs/sec.

Hugo Mills

@darkling@mstdn.social ·Jul 12

Thread reply

@jwz@mastodon.social Depends on the distribution of the incoming requests. If they're from the same 20 IPs (yeah, I know...), then it's a second of work to deal with the problem. If every request is from a different IP, then the work of banning them is pointless. Somewhere between the two, there's a utility to be had.

Roadskater, Ph.D.

@roadskater@mastodon.social ·Jul 12

Thread reply

@darkling@mstdn.social @jwz@mastodon.social Fail2ban has been near useless for me lately due to all the requests coming from apparently compromised home devices. Literally 100s of 1000s of different IPs making the same sort of F-ed requests on some days.

jwz

@jwz@mastodon.social ·Jul 12

Thread reply

@roadskater@mastodon.social @darkling@mstdn.social Yeah, the attackers probing for wordpress or php exploits often make many consecutive attempts from the same IP, but the AI scrapers all seem to have leveled up to residential proxies that never repeat an IP.

Roadskater, Ph.D.

@roadskater@mastodon.social ·Jul 12

Thread reply

@jwz@mastodon.social @darkling@mstdn.social The crazy thing about it, as least from my perspective, is the number of these requests that are for file paths that simply don't exist and never have.

jwz

@jwz@mastodon.social ·Jul 12

Thread reply

@roadskater@mastodon.social @darkling@mstdn.social It almost makes one think that perhaps these AI scrapers are all vibe coded, and perhaps that code is very, very bad indeed. But that can't be true.

Hugo Mills

@darkling@mstdn.social ·Jul 12

Thread reply

@jwz@mastodon.social @roadskater@mastodon.social Did you know that your sarcsamatron is glowing red and giving off smoke? You might need one of the industrial-quality upgrades.

slash

@agreeable_landfall@mastodon.social ·Jul 12

Thread reply

@jwz@mastodon.social Let me find my links (I'm not at home right now), and I'll post the way I had to block all of China, because they kept filling my logs, making it hard to see the non-trivial stuff.

slash

@agreeable_landfall@mastodon.social ·Jul 12

Thread reply

@jwz@mastodon.social OK, here's the site: www.ipdeny.com The provide aggregated country IP netblocks, which are kept up-to-date. On GNU/Linux, I use ipset to turn those blocks into an O(1) lookup. On BSD, PF has tables which do that same job. I have a cron job which runs each week to check for updates to those netblocks. I try to not block too many countries, but China and the Seychelles are huge offenders. Since they're blocked at the packet filter, f2b really isn't needed. And I have summary cron jobs.

Pete®️ Kovář

@1div0@mastodon.social ·Jul 12

Thread reply

@jwz@mastodon.social f2b is focused at single in.ter.fer.net addresses. Banination of whole .hk/.cn is way beyond that spec. And, BTW I we seen attacks on my servers from .jp IPs owned by Alibaba and their 40 thieves.

Cat 🐈🥗 (D.Burch)

@catsalad@infosec.exchange ·Jul 12

@jwz@mastodon.social Damn!

diana 🏳️‍⚧️🦋🌱

@dianea@lgbtqia.space ·Jul 12

@jwz@mastodon.social (gif in slow motion, 0.001 of actual banning speed)

Pete®️ Kovář

@1div0@mastodon.social ·Jul 12

@jwz@mastodon.social Fuck the whole 14.240.0.0/12 Vietnam Posts and Telecommunications Group