Re: Chinese downloads overloading my website

On Mon, 11 Mar 2024 09:53:44 GMT, Jan Panteltje <alien@comet.invalid>
wrote:

On a sunny day (Mon, 11 Mar 2024 06:43:34 -0000 (UTC)) it happened jim whitby
<mr.spock@spockmall.net> wrote in <usm96m$3fkqg$1@dont-email.me>:
>

You may find the file:
>
/etc/hosts.deny
>
useful in this case, you can block by name(s) or ip(s).
Man hosts,deny
for more info

>
I wrote a small script years ago using Linux iptables to reject bad IP adresses.
>
raspberrypi: ~ # cat /usr/local/sbin_pi_95/ireject
# this is called to add a input deny for an IP addres to ipchains,
# and save the configuration.
>
if [ "$1" = "" ]
then
       echo "Usage: reject IP_address"
       exit 1
fi
>
# OLD ipchains
##ipchains -A input -s $1 -l -j REJECT
#ipchains -L
##ipchains-save > /root/firewall
##echo "reject: ipchains configuration written to /root/firewall"
>
#iptables -A INPUT -s $1 -p all -j REJECT
#iptables -A INPUT -s $1 -p all -j DROP
>
echo "executing iptables -A INPUT -s $1 -p all -j DROP"
iptables -A INPUT -s $1 -p all -j DROP
>
echo "executing iptables -A OUTPUT -s $1 -p all -j REJECT"
iptables -A OUTPUT -s $1 -p all -j REJECT
>
iptables-save > /root/firewall2
>
exit 0
>
Therr is an other one 'load_firewall somewhere.
raspberrypi: ~ # cat /usr/local/sbin_pi_95/load-firewall
iptables -F
#/sbin/ipchains-restore < /root/firewall
/sbin/iptables-restore < /root/firewall2
>
>
>
There were many many entries in /root/firewall back then, daily work to keep track of attacks.
Now I am on a dynamic IP address and the website is handled by a company,
saves a lot of time.
>
Things evolve all the time, iptables sets this Raspberry Pi with 8 GB memory as router too,
runs with a Huawei 4G USB stick with IP 192.168.8.100 for net connection, anywhere in Europe I think,
an other script:
>
raspberrypi: # cat /usr/local/sbin/start_4g_router
#!/usr//bin/bash
>
iptables -F
>
route add -net 192.168.0.0/16 dev eth0
>
echo 1 >/proc/sys/net/ipv4/ip_forward
>
iptables -t nat -A POSTROUTING ! -d 192.168.0.0/16 -o eth1 -j SNAT --to-source 192.168.8.100
sleep 1
>
ifconfig eth0 down
sleep 1
>
ifconfig eth0 192.168.178.1 up
sleep 1
>
vnstat -i eth1 -s
sleep 1
>
# default is set to 192.168.8.1, using 8.8.8.8 and 8.8.4.4 google name server lookup
cp /etc/resolv.conf.GOOGLE /etc/resolv.conf
sleep 1
>
# reduce swapping
sysctl vm.swappiness=5
>
echo "ready"
>
>
There is more, but then again, things change over time too.

Blocking a single IP hasn't worked for my ISP.

Each identical 17G download block (262 visits)was by a new IP
in a completely different location/region.

Beijing, Hearbin, Henan, a mobile and a fifth, so far untraced
due to suspension of my site.

RL