Flooded with firewall rules?

It looks like 110.82.208.111 is trying to send you e-mail, and 71.34.61.229 (a DSL connection near Minneapolis) is trying to connect to port 2222. Neither are succeeding.

Define "being flooded"… how many per second? What does "ufw status" say? (Does it say that HTTP is allowed?)

It doesn't look like an attack, and I can connect to port 80 on 66.228.55.188 just fine from here…

I'm starting to think this is definitely some kind of brute force attack.

You can get to the server now, because I rebooted.

But the flood continues, and there are several new attempts once per second.

I am watching them come in live; one IP will make repeated attempts.

Then I block it in my iptables, they pause, and start back up with another ip. I block it, rinse and repeat.

I'm assuming I'm fighting an army of netbots of some sort, all of the IPs are completely different.

Short of sitting here fighting them off one-by-one, what I can do here?

Thanks!

Definitely under attack, here what I'm seeing in auth.log:

==========================

pr 17 20:36:27 electricjet sshd[7816]: Failed password for root from 82.147.114.22 port 60619 ssh2

Apr 17 20:36:29 electricjet sshd[7818]: reverse mapping checking getaddrinfo for 22.114.147.82.nexcom.ru [82.147.114.22] failed - POSSIBLE BREAK-IN ATTEMPT!

Apr 17 20:36:29 electricjet sshd[7818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.147.114.22 user=root

Apr 17 20:36:31 electricjet sshd[7818]: Failed password for root from 82.147.114.22 port 60774 ssh2

Apr 17 20:36:33 electricjet sshd[7820]: reverse mapping checking getaddrinfo for 22.114.147.82.nexcom.ru [82.147.114.22] failed - POSSIBLE BREAK-IN ATTEMPT!

Apr 17 20:36:33 electricjet sshd[7820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.147.114.22 user=root

Apr 17 20:36:35 electricjet sshd[7820]: Failed password for root from 82.147.114.22 port 60931 ssh2

Apr 17 20:36:37 electricjet sshd[7822]: reverse mapping checking getaddrinfo for 22.114.147.82.nexcom.ru [82.147.114.22] failed - POSSIBLE BREAK-IN ATTEMPT!

===========================

I just banned the IP that shows up in the reverse mapping:

82.147.114.22

I'm kind of figuring all of this out on the fly here so if anybody has any good advice on how to stop this I'm all ears.

Edit:

Okay that worked for awhile, but they have started up again.

Can't help you stop the attack, but just wondered if you knew of denyhosts (http://denyhosts.sourceforge.net/) - it will "ban" the offending IP addresses for you, not just for this attack, but all future ones.

I also do something similar for Apache to block http requests from offending sites (a script which looks for phrases like phpmyadmin, proxyheader.php, etc in /var/log/apache2/error.log and adds a new DenyFrom entry to /var/www/.htaccess). Takes care of assaults on ssh and http(s) ports.

Yes, thank you, I discovered DenyHost during my searching on how to stop and/or prevent this in the future. I'm used to seeing random and one-off brute force attacks but this is the first time I've had to fend off a sustained attack big enough to actually flood my server . . . nothing like learning under fire.