Block Connection refused errors
Hi!
This morning i received this connections to my server.... lots of this.... That server was super slow.
All from the same ip, but not all to the same destination. I investigated and found that was a script being used to make connections outside the server. I had to block the ip manually to stop this. Is there any option i can activate in the firewall to block this kind of errors if for example this happens 15 times in 5 minutes or something like this...? Thanks Nuno Leite
[Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * connect to xx.xx.xx.xx port 80 failed: Connection refused
[Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Failed to connect to randomhack.wf port 80: Connection refused
[Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Closing connection 0
[Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * connect to xx.xx.xx.xx port 80 failed: Connection refused
[Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Failed to connect to randomhack.wf port 80: Connection refused
[Mon Oct 13 10:03:15 2014] [error] [client xx.xx.xx.xx] * Closing connection 0All from the same ip, but not all to the same destination. I investigated and found that was a script being used to make connections outside the server. I had to block the ip manually to stop this. Is there any option i can activate in the firewall to block this kind of errors if for example this happens 15 times in 5 minutes or something like this...? Thanks Nuno Leite
-
Hello :) Are you using a firewall management utility such as CSF or just custom iptables firewall rules? Thank you. 0 -
Hi! I'm using CSF. I already configured the LF_APACHE_404 = 100 cause i have a lot of "File does not exist". But to block this kind of erros in the 1st post i can't find the option to do this.... is it LF_APACHE_403 ? Thanks for your help Nuno Leite 0 -
I don't believe the "LF_APACHE_403" option would help based on the output you provided. You may want to post directly to the CSF forums for assistance with the options you can use to prevent this type of activity: [url=http://forum.configserver.com/viewforum.php?f=6]ConfigServer Community Forum • View forum - General Discussion (csf) Thank you. 0 -
Hi! I posted this question on their forum, but i'm waiting for an answer since 15/october. Can anyone help here? Thanks Nuno Leite 0
Please sign in to leave a comment.
Comments
4 comments