iptables - block empty user agents

SysTeam · #1 09-09-2009, 03:59 PM

How to block requests with empty user agents using iptables firewall?

nomankhn · #2 09-09-2009, 04:42 PM

Quote:

Originally Posted by SysTeam

How to block requests with empty user agents using iptables firewall?

iptables is not use for that purpose, use modsecurity or block via apache,

here is example to block via apache with modrewrite.

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} [regex to match user agent]
RewriteRule ^/.* - [F]
</IfModule>

Just keep in mind that user agents can always be spoofed, so there's nothing keeping the "attacker" from pretending to be Googlebot, Firefox, MSIE, or any other browser or "good" bot. For that matter, blocking by IP only works so long as the "attacker" is using the same IP; if an attack comes from a botnet with thousands of zombie hosts, there's not a lot you can do about that.

SysTeam · #3 09-09-2009, 05:04 PM

I successfully block DDoS attack (10000+ bots) using only user agent filters in iptables. Now, my webserver (nginx) still handle requests from bots (without user agents). Nginx block this requests, but would be much more effective to block using iptables.