I'm being trolled by China, and don't know why I can't block their request to my server.//host.denyALL: item.taobao.comALL: 117.25.128.*But when I watch the error log on my webserver tail -f /var/log/apache2/error.log the requests are still being allowed through.Question: Why isn't my /etc/hosts.deny config working?
Editing my /etc/hosts.deny
networking;security;hosts;tcp wrappers
The file is called /etc/hosts.deny, not host.denyNot all services use tcp-wrappers.  sshd, for example, doesn't by default.  Neither does apache.You can use iptables to block all packets from 117.25.128/24, e.g.: iptables -I INPUT -s 117.25.128.0/24 -j DROPEven better, you can use fail2ban to monitor a log file (such as apache's access.log and/or error.log) and automatically block IP addresses trying to attack your server.  From the debian fail2ban package description:Fail2ban monitors log files (e.g. /var/log/auth.log,   /var/log/apache/access.log) and temporarily or persistently bans   failure-prone addresses by updating existing firewall rules.Fail2ban allows easy specification of different actions to be taken such as to ban an IP using iptables or hosts.deny rules, or simply to send a notification email.By default, it comes with filter expressions for various services   (sshd, apache, qmail, proftpd, sasl etc.) but configuration can be   easily extended for monitoring any other text file.  All filters and   actions are given in the config files, thus fail2ban can be adopted   to be used with a variety of files and firewalls.