Forum Moderators: phranque

Message Too Old, No Replies

Blocking RIPE, APNIC, AFRINIC, and LACNIC

         

csdude55

12:11 am on May 10, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Most of the sites on my server only target US traffic, but a few deal with international so I can't really block through the firewall. Currently, I have a MySQL table with a series of IP ranges listed, and I allow each user to access that table in their header and deny access to any IP within a found range, which saves a lot of server stress but it doesn't help prevent spam (unfortunately).

I'm pasting below the IP ranges that are being blocked. I'm concerned about the list staying updated, though... I had one local internet provider that started using what used to be a foreign IP range, so now I worry that I need to access an up-to-date public database somewhere.

So the first question is, can you guys recommend a way to block RIPE, APNIC, AFRINIC, and LACNIC IPs on a site level? And, if possible, on an email level?

If not, what are your thoughts on permanently blocking the following IP ranges? If it's not a good idea, do you know of a public database I can use instead of gathering them locally?

# Russia .ru
89.0.0.0/8

# RIPE.NET (Europe, the Middle East and parts of Central Asia)
62.0.0.0/8
77.0.0.0/8
78.0.0.0/8
79.0.0.0/8
80.0.0.0/8
81.0.0.0/8
82.0.0.0/8
83.0.0.0/8
84.0.0.0/8
85.0.0.0/8
86.0.0.0/8
87.0.0.0/8
88.0.0.0/8
89.0.0.0/8
90.0.0.0/8
91.0.0.0/8
193.0.0.0/8
194.0.0.0/8
195.0.0.0/8
212.0.0.0/8
213.0.0.0/8
217.0.0.0/8

# APNIC (Asian Pacific Network Information Center)
58.0.0.0/8
59.0.0.0/8
60.0.0.0/8
61.0.0.0/8
202.0.0.0/8
203.0.0.0/8
210.0.0.0/8
211.0.0.0/8
218.0.0.0/8
219.0.0.0/8
220.0.0.0/8
221.0.0.0/8
222.0.0.0/8
116.0.0.0/8
117.0.0.0/8
118.0.0.0/8
119.0.0.0/8
120.0.0.0/8
121.0.0.0/8
122.0.0.0/8
123.0.0.0/8
124.0.0.0/8
125.0.0.0/8
126.0.0.0/8

# LACNIC (Latin American and Caribbean Network Information Center)
189.0.0.0/8
190.0.0.0/8
200.0.0.0/8
201.0.0.0/8

# Other
141.0.0.0/8
88.0.0.0/8
85.0.0.0/8

keyplyr

1:51 am on May 10, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



what are your thoughts on permanently blocking the following IP ranges?
I think it is a very bad idea.

Blocking regional IP blocks is basically shooting yourself in the foot. You have no knowledge what is in those ranges that can benefit your interests.

Blocking is a tricky endeavor. I only recommend blocking *server ranges* that have no beneficial effect to your interests: Blocking Server Ranges [webmasterworld.com]

.

csdude55

3:00 am on May 10, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I gotcha. And your other post made me remember another concern... search engine robot IPs! I don't want to block them, either.

But like today, I saw my RAM load had skyrocketed, and when I looked at the connections I saw that I had a handful of non-US IPs making literally hundreds of connections that were eating up my resources. I started blocking them manually, and the load dropped down.

I had a similar experience just a few days ago, too.

I have the number of connections in Apache set to 30, so I don't know how some of them were hitting 200... but they were.

So other than blocking the IP, how would you suggest preventing that?

keyplyr

3:11 am on May 10, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



There are several default methods of blocking:

• Check Header fields and block if abnormal

• Block known server farm IP address ranges: Server Farm IP Ranges [webmasterworld.com]

• Block by behavior: too fast, requests for pages but no other file types, supporting files but no pages, using same page as referrer.

• Block by User Agent: block known scrapers & malicious actors Search Engine Spider & User Agent ID Forum [webmasterworld.com]

• Block if no UA

• Block if protocol HTTP/1.0

• Block if changing UAs more than 3Xs.

• Block by referrer: hot-linking, bad neighborhoods, etc

• Block if redundant requests for same page more than 3Xs within a time frame.

Note: If you choose to block without prejudice, be prepared to watch your server logs each day with diligent focus to see just who exactly is being blocked. This takes consistent maintenance.
---

csdude55

12:45 am on May 12, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



For the sake of posterity...

Yesterday, my server load started spiking and the server kept crashing. I use this (on Linux) to find how many connections I'm getting from each IP:

netstat -plan | grep :80 | awk '{print $5}' | cut -d : -f 1 | sort | uniq -c | sort -nr | head


I was definitely getting hammered by foreign IPs, and as soon as I would block one another would pop up. So I ended up blocking all of the IPs in that list until I could figure out a better alternative. The load went down quickly, and everything came back under control.

But then today, I had several reports from people on mobile devices that they were unable to connect to any of my sites. I removed the IPs from the firewall, and they were able to connect again. So at least one of those IP ranges now belong to a US mobile provider (Verizon, I think), but I don't know which one(s).

So don't use that list unless you have no other choice. It needs some tweaking, and I'm guessing that they'll continue to change regularly enough that a list that works well today may not work well tomorrow.

keyplyr

1:24 am on May 12, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Before blocking any IP range, it's imperative to look it up to see who you're blocking. There's a lot of online tools you can use manually, or you can set up an rDNS at your server and compare with a compiled whitelist of friendly IP ranges using your favorite scripting language.

Sometimes the perp will use a botnet consisting of dozens of compromised ISP and hosting accounts. While it may help to block these IPs initially, they usually are never used again after a couple days so.