Question for server security gurus - GoFuckYourself.com

donnie · 08-08-2012, 03:49 AM

We have a server that is constantly attacked by Chinese idiots. Is there a way to completely block all IP?s from China reaching the server? I am not only talking about blocking them from the site but completely blocking them from server. So they can?t scan ports, make login attempts etc.

We are running CentOS 6 on this server if that makes any difference.

V_RocKs · 08-08-2012, 04:08 AM

Well... most hosts and nice people will tell you not to block entire ip subsets like that... But back when I ran tgp's for a living I used to block them and Russia...

Easy to do... But you are going to have to google for specific instructions for your server... freebsd? linux? windows?

facialfreak · 08-08-2012, 04:32 AM

Also keep in mind that as IPv4 IP addresses have become so scarce, that people are selling off their hoarded subnets to the highest bidder, and blocking by GEO-location may not ensure that you are blocking the Chinese hackers.

I have seen US servers serving Indonesian IPs, and likewise I have seen Chinese servers serving German IP addresses ... as IPv4 addresses become harder to get, IP subnets are ending up in use in all different parts of the world.

CurrentlySober · 08-08-2012, 04:33 AM

Unplug your server from the internet - Job done & problem solved..

ladida · 08-08-2012, 05:00 AM

Quote:

Originally Posted by donnie

We are running CentOS 6 on this server if that makes any difference.

Quote:

Originally Posted by V_RocKs

But you are going to have to google for specific instructions for your server... freebsd? linux? windows?

:facepalm:

Klen · 08-08-2012, 05:22 AM

Had same problem with china,resolved it with this:
http://www.configserver.com/cp/csf.html
All what you need to do it it's to put CH into country block field and no more chinese on your server.

BNMedia · 08-08-2012, 11:09 AM

I had my host (ISPrime) block Russia using geoip, so yes(ish)
It doesn't stop them using proxies though!

Klen · 08-08-2012, 11:35 AM

Quote:

Originally Posted by BNMedia

I had my host (ISPrime) block Russia using geoip, so yes(ish)
It doesn't stop them using proxies though!

I have reason to believe if you block russia and china traffic you will reduce like 80% chance to be hacked and have any problem,and while they can use proxies they mostly uses their own ip's and it's all automated.

rowan · 08-08-2012, 11:36 AM

Quote:

Originally Posted by KlenTelaris

Had same problem with china,resolved it with this:
http://www.configserver.com/cp/csf.html
All what you need to do it it's to put CH into country block field and no more chinese on your server.

CH is actually Switzerland.

CN is China.

Klen · 08-08-2012, 11:39 AM

Quote:

Originally Posted by rowan

CH is actually Switzerland.

CN is China.

Typo :D

donnie · 08-08-2012, 12:06 PM

Quote:

Originally Posted by KlenTelaris

Had same problem with china,resolved it with this:
http://www.configserver.com/cp/csf.html
All what you need to do it it's to put CH into country block field and no more chinese on your server.

Thank you so much man!!! Portscans and failed logins dropped like 99% today after I blocked China and Russia with this.

08-08-2012, 03:49 AM	#1
donnie Confirmed User Join Date: Jan 2003 Posts: 1,630	Question for server security gurus We have a server that is constantly attacked by Chinese idiots. Is there a way to completely block all IP?s from China reaching the server? I am not only talking about blocking them from the site but completely blocking them from server. So they can?t scan ports, make login attempts etc. We are running CentOS 6 on this server if that makes any difference.

08-08-2012, 04:32 AM	#3
facialfreak Confirmed User Join Date: Feb 2005 Location: Montreal Posts: 3,018	Also keep in mind that as IPv4 IP addresses have become so scarce, that people are selling off their hoarded subnets to the highest bidder, and blocking by GEO-location may not ensure that you are blocking the Chinese hackers. I have seen US servers serving Indonesian IPs, and likewise I have seen Chinese servers serving German IP addresses ... as IPv4 addresses become harder to get, IP subnets are ending up in use in all different parts of the world. __________________ Managed Shared Hosting starting at $4.99/mo Managed VPS starting at $29.99/mo

08-08-2012, 04:33 AM	#4
CurrentlySober Too lazy to wipe my ass Industry Role: Join Date: Aug 2002 Location: A Public Bathroom Posts: 37,994	Unplug your server from the internet - Job done & problem solved.. __________________ My AI Handywork... 2 Kings 18:27 👁️ 👍️ 💩

08-08-2012, 05:22 AM	#6
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,234	Had same problem with china,resolved it with this: http://www.configserver.com/cp/csf.html All what you need to do it it's to put CH into country block field and no more chinese on your server. __________________ For GFY administration inquiries- email info at gfy.com or send PM. For advertising inquiries - email marketing at gfy.com Inquiries which are not related to administration or advertising on GFY wont be processed.

08-08-2012, 11:09 AM	#7
BNMedia Confirmed User Industry Role: Join Date: Nov 2009 Posts: 433	I had my host (ISPrime) block Russia using geoip, so yes(ish) It doesn't stop them using proxies though! __________________ --------------------------------------------------------- Webmaster of www.kinkykicks.net - Your 1 stop resource for ballbusting and cruel sexual femdom. Join our affiliate program at www.cash4kicks.com

08-08-2012, 04:08 AM	#2
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,311	Well... most hosts and nice people will tell you not to block entire ip subsets like that... But back when I ran tgp's for a living I used to block them and Russia... Easy to do... But you are going to have to google for specific instructions for your server... freebsd? linux? windows?