Iptables – Block traffic behind AWS ELB

amazon-elbapache-2.2iptablesmod-rewritemod-security

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts:

  1. Blocking IP address at ELB level is not possible because it has limit of 20 IP addresses and IP addresses change at every attack.

  2. Block access using rewrite condition, this works but if lot of hits come then server load goes beyond 100 and all apache threads become busy in serving tons of 403 so site appears down for legitimate requests.

    RewriteCond %{HTTP_USER_AGENT} ^SomeThing

RewriteRule ^(.*)$ - [F]

  3. Block with mod_sec does same thing of serving 403 which create same effect as #2 above.

  4. Block packets with iptables string module: Block packets which have specific user agent. In this scenario iptables sends DROP/ REJECT to attacker, apache doesn't get signal that the connections is now dead and waits for a timeout which cause all apache threads in use for timeout, so this method is not useful here.

    iptables -I INPUT -i eth0 -p tcp --dport 80 -m string --algo bm --string 'user-agent: SomeThing' -j REJECT

Can I use iptables such way that it will get IP address from first packet which has user-agent: SomeThing and block all the next packets which has X-Forwarded-For: someIP for 4-5 hours. I don't want to keep the IP address blocking always as these IP Addresses can be assigned to some legitimate users and that will be blocked.

Or is there any other better way to handle this attack ?

Best Answer

Alternatively, don't use ELB but roll out your own load balancer using HAProxy.

If you've been deploying your site using AWS OpsWorks, you should be aware that AWS OpsWorks supports a HAProxy-based Load Balancer Layer.

Yes, preparing a HAProxy Load Balancer Layer is much more involved than simply spinning up an ELB set, but ultimately it allows you to fully customize the iptables setting, even using fail2ban.

Edit: If configuring Chef recipes is not your dish (:D), I have an alternative. I've just created a FOSS project called haproxy-autoscaling, hosted on bitbucket, if anyone care to check it out. It's almost finished. Already usable, but needs some manual manhandling.

URL: https://bitbucket.org/pepoluan/haproxy-autoscaling/overview

Related Topic