I have a game server and someone is spamming it with bots. The SpamBot client makes the handshake with my server using UDP connections. It does this through a list o proxies. Basically, the Spambot Client sends lots of UDP packets to my server and spams it with bots. Now I've got like 6 big lists of proxies that I know the person who spambots me use them. I can write alone the shell script to block every ip from every list. Every ip is on a new line, so it's pretty easy to do it with a for loop. The problem is that I'm concerned about the performance of my server. If I'll block 15k ip addresses, isn't that going to affect my server's performance? ATM I run Centos 7. Can you tell me if IP Tables is the good way to go, or what other alternatives should I try. Please write the commands too. I just want my server to stop responding to these IP Adresses, to not estabilish any connections with them. Thank you!EDIT: I googled alot about my problem, but I can't find anything helpful. Some people say that using ip tables is going to affect my CPU's performance, other recommend using it. EDIT 2: I'm gonna get back in 1 day with the answers wich method is the most effiecient and less performance consuming.
Mass IP Blocking
centos;iptables;ip;udp
For such a large amount of IPs you should use the ipsets module.ipset creates datasets on which iptables can react, it can easily handle 10s of 1000s of entries.Make sure you have the EPEL repo enabled and then install ipset via:yum install ipsetAn example:ipset -N blockedip iphashcreates a set called 'blockedip' in format 'iphash' (there are different formats, this one is for IPs only).with ipset -A you can add data (in this case IPs) to the dataset:ipset -A blockedip 192.168.1.1ipset -A blockedip 192.168.1.2and so on...Or to batch create it without having to run one ipset invocation for each IP address, assuming you big-file.list is a list of IPv4 addresses, one per line:ipset -N blockedip iphashsed 's/^/add blockedip /' < big-file.list | ipsec restoreWith the following iptables command you can tell the kernel to drop all packets coming from any of the sources in this set:iptables -A INPUT -m set --set blockedip src -j DROP