Anti flood protection?

[Scott Galambos]

How do I make my cPanel v70.0.48 server block and IP that is connected more then say 50 times to all ports? I keep getting flooded by these bots scanning for Wordpress holes. A fancy netstat command I have will show the count of the connections. eg.
42.234.2.4 = 85
etc.

I simply want to automatically csf deny when an IP is greater then like 75. I would need a whitelist too though. Does anything like this exist?

 

[Infopro]

I simply want to automatically csf deny when an IP is greater then like 75. I would need a whitelist too though. Does anything like this exist?

Yes, in CSF. There are built in options for port scanning.

 

[Scott Galambos]

Is this the CONNLIMIT = "" setting in csf.conf? It not necessarily port scanning I'm trying to stop, its many hits to URLs on WP sites I'm trying to mitigate. So all connections are for port 80. If I do CONNLIMIT = "40" does that mean any single IP cannot connect more then 40 times to port 80/443?

 

[Infopro]

I can't explain CSF any better than the readme can:
https://download.configserver.com/csf/readme.txt

20. Connection Limit Protection
###############################

This option configures iptables to offer protection from DOS attacks against
specific ports. It can also be used as a way to simply limit resource usage by
IP address to specific server services. This option limits the number of new
concurrent connections per IP address that can be made to specific ports.

This feature does not work on servers that do not have the iptables module
xt_connlimit loaded. Typically, this will be with Monolithic kernels. VPS
server admins should check with their VPS host provider that the iptables
module is included.

Also, although included in some older versions or RedHat/CentOS, it was only
actually available from v5.3+

The protection can only be applied to the TCP protocol.

Syntax for the CONNLIMIT setting:

CONNLIMIT is a comma separated list of:
port;limit

So, a setting of CONNLIMIT = "22;5,80;20" means:

1. Only allow up to 5 concurrent new connections to port 22 per IP address

2. Only allow up to 20 concurrent new connections to port 80 per IP address

Note: Existing connections are not included in the count, only new SYN packets,
i.e. new connections

Note: Run /etc/csf/csftest.pl to check whether this option will function on the
server