logoalt Hacker News

kevin_thibedeauyesterday at 11:41 PM2 repliesview on HN

I perma-ban any /16 that hits fail2ban 100+ times. That cuts down dramatically on the attacks from the usual suspects.


Replies

BLKNSLVRyesterday at 11:45 PM

I haven't manually reviewed my lists for a while, but I did similar checks for X IP addresses detected from within a /24 block to determine whether I should just block the whole /24.

Manual reviewing like this also helped me find a bunch of organisations that just probe the entire IPv4 range on a regular basis, trying to map it for 'security' purposes. Fuck them, blocked!

P.S. I wholeheartedly support your choice of blocking for your reasons.

show 1 reply
lxgrtoday at 12:18 AM

Sounds like a great idea until you ever try to connect to your own servers from a network with spammy neighbors.

show 2 replies