Blocking IP ranges or Countries

[AWD_ENVY]

Is there a way to limit connection per IP (on apache?)????

I've had a TON of junk, hack attepts...etc comming from Germany and Australia lately.

The stuff on my VPS is stricly local to US and as far as I'm concerned I dont care if other countries can ever get to it. How do I go about blocking IP ranges ?

I looked at this thread:

and found this
/sbin/iptables -A INPUT -s IP_TO_BLOCK -j DROP; /sbin/service iptables save

but when I try to ad an IP address I get a nice little error:
iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.


Additionaly i'm not sure how I add a range of IPs to block.

Any help would be greatful.

[Smithjp]

How do I go about blocking IP ranges ?

The recommended appraoch is to have apf and bfd installed on the VPS. bfd works with apf and search the logs for fail login attempts and block those Ips on the server.

iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

iptables modules need to be enabled for your VPS. Please open a support ticket to get them enabled for your VPS.

[Connie]

A VPS may be different, but I would think you could do this with your .htaccess file using something like this.
<Files 403.shtml>
order allow,deny
allow from all
</Files>
deny from 64.12.0.0 - 64.12.255.255

[Vin DSL]

Heh!

Yeah, you can ban countries. I've banned about half of China, for instance, with a couple of IP ranges -- as described by Connie...

[Gwaihir]

On VPS he has the option to make these blocks on a lower level. That way connections from such IPs take (even) less resources and give (even) less chances to hack something.

[Vonna.com]

When you get iptables setup use it like this:

iptables -I INPUT -s 55.55.55.55 -j DROP

This will block the ip 55.55.55.55

iptables -I INPUT -s 55.55.55.0/24 -j DROP

To block a range of ip's , you use netmask, like above it will block the entire "block c" range.

Now all you have to do ( a lot of work ) is type in all the ip ranges for Germany ( i have attached a list for you).

REMEMBER to save the iptables rules, it only stores it in memory, so if you reset everything is lost, so remember this:

iptables save

If your problem is mainly hacking attempts, you could just ask support to get APF installed , it will block any ip's using iptables that are trying to "Brute Force" hack your system.

Also install "Mod Security" it will also stop some hack attempts.