Thousands of incoming HEAD requests - best way to handle with EC2?
Dec 23
I had unusually high https traffic recently from a couple of IP address with agents masquerading as Windows clients. I blocked the range via 'deny' inside of .htaccess (Apache 2.4)
I'm still getting nearly 1,000 HEAD requests per second, which httpd is correctly responding with a 403...but the incoming pings are still coming.
I'm on an AWS EC2 and was looking at options there (aside from going to WAF/load balancer, etc). Should I be configuring a network firewall for this, or is there some other simple way to halt this traffic at the ingress to the EC2 instance?
(edit) I did just now add that subnet to the EC2 network ACL inbound rules (deny), and it seems to be working...maybe that is the right answer?
1 answer
Accepted answer · original discussion
Dec 23
The simplest way to block a small number of IP addresses on AWS is NACLs (network access control lists). NACLs are ideal because they have both ALLOW and DENY rules, which let you DENY a few IPs then ALLOW a large range - usually 0.0.0.0/0.
Security groups, on the other hand, only have allow rules. If you wanted to exclude one IP you'd have to go to a lot of trouble to craft a whole set of allows that would make up all IPs you want less the one you don't want, which would be a lot of rules.
If the traffic you don't want is from many IPs you'd be better off with AWS WAF or an external service such as CloudFlare. CloudFlare has free and paid plans, their free plan is sufficient for many personal servers, and their paid plans are pretty good value. NB: I have no association with CloudFlare, I just like their service.
Fail2ban is another option. The downside of this or similar options is you still need to use bandwidth and CPU to deny these requests. I prefer to use a CDN to prevent them reaching the server at all.
1 question comment
Use comments to ask for clarification. Post a solution as an answer.
Dec 25