0

I am getting Wordpress pingback attach on my server. I tried to put if condition on nginx to block deny all requests that contains "Wordpress" in the header. It works fine but still nginx get millions of requests per second and it is useful solution. Then I tried following solution that works better:

There are thousands of IPs involved in the attack on only port 80. I used following rule to block this attack:

iptables -A INPUT -p tcp -m recent --update --seconds 600 --name PINGBACK --rsource -j DROP
iptables -A INPUT -p tcp -m tcp --dport 80 -m string --string "WordPress/" --algo kmp -m recent --set --name PINGBACK --rsource

This rule is from this site. It works all fine. However, the IPs keep coming back and my system tried to keep blocking the packets. I want to log the list of all these IPs which contain "WordPress" in the header. Is it possible to do it?

EDIT

dmesg output

net_ratelimit: 346 callbacks suppressed
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
net_ratelimit: 483 callbacks suppressed
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
nf_conntrack: table full, dropping packet
net_ratelimit: 5 callbacks suppressed
  • Have you checked dmesg? – mchid Feb 1 '16 at 2:03
  • mchid, I am a noob and sorry don't know much about dmesg. Also, I have deleted the question on askubuntu to avoid any duplicates. – user3404047 Feb 1 '16 at 2:16
  • Open a terminal and type dmesg. If you find a word like DROP that you want to search the results for or WordPress, you can do that like so: dmesg | grep DROP or dmesg | grep WordPress or you can use regex with egrep to search for more than one word like so: dmesg | egrep 'DROP|WordPress' – mchid Feb 1 '16 at 2:20
  • @mchid, I added dmesg output in my question. That's all it produced. Running grep didn't produce any output. I am not sure why it's full or what does it mean though. – user3404047 Feb 1 '16 at 3:04
  • maybe this will help gr8idea.info/os/tutorials/security/iptables5.html – mchid Feb 1 '16 at 3:45
1

In your case, /proc/net/ipt_recent/PINGBACK (or /proc/net/xt_recent/PINGBACK in some installations) contains the list of all IP addresses seen as WordPress bots during last 600 seconds. This is a text file which is updated automatically in real time by the system.

You can either collect data from this file over some period of time or set an interval bigger than 600 seconds in your iptables rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.