2

Our server being hammered by traffic from some particular IP. It was causing a 20x increase in traffic to some URLs. So I wanted to block all traffic from that single IP.

3

Yes, we can block traffic from single IP or IP range. Please follow below steps to do this

Open VPC dashboard

enter image description here

Open the Network ACLs view

enter image description here

Open the ACL editor

  1. Select the subnet to which your EC2 instances or load balancers are connected.

  2. Click Inbound Rules

  3. Click Edit

enter image description here

Add a rule to block the traffic/IP

You will now see the ACL editor. On the last row, you can add a new rule.

enter image description here

Here is how you should fill out the fields:

Rule

Use any number less than 100, which is the number of the default accept-all rule. This is important because rules are evaluated in order, and your rule needs to come before the default.

Type

Select “All traffic” or Particular Protocol which you want to Block

Source

The CIDR you want to block. To match a single IP address, enter it here and append /32. For example, I blocked 22.87.45.187/32

Allow/Deny

Select “DENY”

Now click Save and you should see the updated rules table.

Fore more details visit https://www.serverkaka.com/2018/05/block-traffic-from-single-ip-in-aws.html


UPDATE: How to do it in CLI

NOTE: This example command includes --dry-run option, so it is safe to run. It will not create NACL rule. Run it without this option, if you want to apply it.

aws ec2 create-network-acl-entry --dry-run --network-acl-id acl-146adb6f --ingress --rule-number 20 --protocol tcp --port-range From=80,To=80 --cidr-block 22.87.45.187/32 --rule-action deny

More examples: https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-acl-entry.html#examples

  • 1
    This can also be done via command line. Additionally you can use Fail2Ban to detect the problematic source and then use your own custom script to assert the NACL rule to block that IP. As well you can incorporate additional scripts to release after X (e.g. 30 minutes) the rule. Sorry, I cannot post an example as I was not allowed to copy the work I did to create just this. – Steven K7FAQ Jan 26 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.