Ban IP Address don't work

[Konstantinus]

I tried to ban the IP address, but I still see it in the logs.

Restarting the web server has no effect.

Cloudflare blocks 99% of all requests. But I encountered a situation where tens of thousands of requests were coming from one IP address at intervals of 1-2 seconds. All of them were going to the same link. It’s possible that some kind of bot malfunctioned. Cloudflare considered these requests to be legitimate. I decided to add the IP address to the block, but without results. That’s why I was surprised. The functionality seems to be there, but it seems to be completely useless.

[sahsanu]

Manual banned ip

@Konstantinus It’s better not to revive a topic that’s two years old, you can reference it, but it’s better to open a new one. Anyway, are you using a CDN like Cloudflare? If the answer is yes, the IP you see in the logs isn’t connecting directly to your server, it’s a Cloudflare IP that’s connecting, so the firewall rule has no effect.

[Konstantinus]

But is the IP blocking feature available in the panel? If it doesn’t work, can it be removed?

[sahsanu]

@Konstantinus

But is the IP blocking feature available in the panel?

Yes, it is.

But the IP you see in the logs is not the real client IP connecting to your server, Cloudflare is the one connecting to your server. The IP you see is the origin IP extracted from the CF-Connecting-IP header sent by Cloudflare. Therefore, you can’t block the IP shown in the logs at the server level, you must block it on Cloudflare’s end.

[Konstantinus]

@sahsanu

Yes, it is.

But the IP you see in the logs is not the real client IP connecting to your server, Cloudflare is the one connecting to your server. The IP you see is the origin IP extracted from the CF-Connecting-IP header sent by Cloudflare. Therefore, you can’t block the IP shown in the logs at the server level, you must block it on Cloudflare’s end.

Yes, I agree.

But when I blocked the IP at the nginx level (deny xxx.xxx.xxx.xxx;), I got a 403 error in the logs. That is, I potentially unloaded the web server from executing requests to the database.

[sahsanu]

@Konstantinus

But when I blocked the IP at the nginx level (deny xxx.xxx.xxx.xxx;), I got a 403 error in the logs.

That’s because, for Nginx, the real IP is that one, not Cloudflare’s IP and that’s due to this configuration added by Hestia:

❯ grep real_ip_header /etc/nginx/conf.d/cloudflare.inc
real_ip_header CF-Connecting-IP;

If you want to block just a few IPs, that’s fine, but it’s an inefficient way to do it.

[MAN5]

I bit confused on this.

1. My apache2 logs shows my exact IP 1.2.3.4 as visitor (Not CF IP)
2. So, i banned my 1.2.3.4 in WEB chain, it supposed to block. Is it ?
3. But, is not blocked.

[ufuk]

The incoming ip is the ip of Cloudflare and not the abuser IP.

How ever hestiacp rewrite the ip for logging.
Source: Firewall IPSet Test. Is not working properly? - #4 by eris

In short, if you proxy through CF (orange cloud), HestiaCP cannot block that IP address. You’ve effectively handed security over to CF. For some reason, CF still forwards IPs with an abuse score of 100 to our servers. If you want to block the IP address on the HestiaCP side, you need to switch it to the gray cloud. So you need to decide which side will handle security.

[MAN5]

OK, thank you for detailed guide.