|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
#1
|
|||
|
|||
|
I remember hearing / reading that it's possible to route incoming requests from a specific IP to 127.0.0.1 to minimize the effects of 'hammering' on your server. -Am I remembering correctly or can someone perhaps point me in the right direction?
The actual issue is that I have some moron of a spammer hammering the living heck out of my Win2K server with attmepts to deliver spam. Hammering to the point that my mail server (TNSoft's mail server) is peaking at 90% CPU from time to time. The requests are all coming from 1 of 3 IP's (blocked) but the resource usage is unacceptably high. I had read that routing requests from xxx.xxx.xxx IP(s) to 127.0.0.1 could help, but I'm afraid I have no idea of how to do this (if, in fact, the assumption is correct). Thanks in advance for any help on this one!
__________________
-------------------------------------------- Just because you're paranoid doesn't mean they're not out to get you. -------------------------------------------- |
|
#2
|
|||
|
|||
|
what do you mean they are blocked? You should be blocking this from your firewall not the server (this is also why you dont use a server with software firewall). If you dont have a firewall at the router put an ACL in there that blocks those three address' from coming in or you can route them to null0. basicly you are under a DOS attack, and can call your ISP and have that blocked from there also.
|
|
#3
|
|||
|
|||
|
Thanks for the reply juniperr,
Unfortunately this is on a box colocated with an ISP who doesn't provide much in the way of firewalls, etc... I agree that best practices say to put the workload of filtering on something other than the server but in this instance it's not an option I have available. The 'blocking' that's taking place at this point is all on the mail-server side, using it's built in anti-spam features. While they work fine for refusing connections from a few IP's - or even a lot of IP's under a light load with ocassional requests - they're not coping well with a high amount of hammering. -Hence my hope for another solution (like redirecting all request from IP xxx.xxx.xxx.xxx:110/25 to 127.0.0.1 - in other words, "right-back-at-ya". |
![]() |
| Viewing: Dev Shed Forums > System Administration > Networking Help > Route incoming request to 127.0.0.1? |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|
|