How to block useragent?

Question

Nginx

The site is ddosed with the following requests:

127.0.0.1 - - [27/Feb/2018:00:16:23 +0300] "POST /payment.php HTTP/1.0" 302 0 "-" "-"

127.0.0.1 - - [27/Feb/2018:00:16:24 +0300] "GET // HTTP/1.0" 200 33183 "https://XXXX.ru/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"

How to disable them at the iptables level?

Answer 1

Parsing the user agent at the iptables level is not a good idea - every packet will be checked there and it will be very expensive in terms of resources. Also, it won't work for https.
User agent blocking can be done at the web server level.
Or log attempts by the web server, and block via iptables using fail2ban, for example already at the address.

Answer 2

Solve this problem at the nginx level through limit_req and not through UserAgent. If you have an external payment connected, then when filtering the UA, requests from it will not be received, since third-party services do not care about setting the UA when informing the payment status.

Answer 3

If there is an Apache web server, then you can block it through htaccess:

SetEnvIfNoCase user-Agent *Slurp* [NC,OR]
SetEnvIfNoCase user-Agent *Baiduspider* [NC,OR]
SetEnvIfNoCase user-Agent ^DuckDuckBot [NC,OR]
SetEnvIfNoCase user-Agent ^Sogou [NC]

Order Allow,Deny
Allow from all
Deny from env=bad_bot

Answer 4

grep you select addresses with the UA of interest and in iptables on DROP