I manage a few dozen servers that are publicly accessible and must remain so. I see very large volumes of malicious traffic on all of these servers. The malicious traffic starts as port scans (identified by scanlogd) and progresses to a combination of ssl vulnerability and web server exploit attempts on port 443 (identified by the nginx error log) and ssh login dictionary attacks on the ssh port (identified by the sshd journal logs). The attacks are so far not successful, because we keep our OS and webserver up to date with security patches, and sshd expects key (rather than password) logins. Additionally, I have nftables configured to drop packets from any IP that engages in the probe activity described above. The systems I manage continue to log IP addresses of deflected/dropped traffic. I store that data in a central db so that I can analyse it in order to understand the threats faced by these systems.
I am working to reduce the attack surfaces by moving the ssh port behind a Wireguard interface on each instance. However, the malicious traffic I see is incessant. Most of it originates from IP blocks owned by ChinaNet which don't respond to IP abuse reports and clearly are happy for their network addresses to be used in this illegal and unethical manner. The volumes I see range from a hundred thousand to a million daily attack probes originating from each of about 50 to 100 different ChinaNet IP addresses, with a total volume of about 3 or 4 million attack probes daily. There is a not insignificant amount of bandwidth consumed by these probes which I must pay for, even when I drop the packets.
I would like to know if there is a DNS provider who can drop or misdirect (to an IP that I maintain) DNS queries that originate from specific subnets. I currently use Cloudflare and Route 53 DNS services but cannot find a way to configure either one to reroute malicious inbound traffic. Route 53 only provides configurability for outbound. I am considering running my own DNS in order to achieve this but does someone know how to do this?