0

I have a service in my page (hosted behind an Oracle server) that is being attacked by specific IPs. I see this in the Apache logs:

201.17.83.xxx, 201.17.83.xxx 10.0.1.xxx - - [14/Jun/2024:10:46:58 -0300] "GET...

However, in my page using PHP, I can only detect the local Oracle IP 10.0.1.xxx: all requests are coming from 10.0.1.xxx, I see nothing external.

I tried to block 201.17.83.xxx with .htaccess, but it also sees only the local 10.0.1.xxx.

What can I do now to block the specific IP? Is that even possible? Maybe with cookies?

BTW: yes, yes, I know that IPs can be spoofed, but I have not seen this problem yet.

Improve this question
5
  • It sounds like you have a reverse proxy or load balancer that is hiding the source IPs from you. In that case you need to configure the reverse proxy or the load balancer to block the IP, not the web app/service running on apache. No you cannot block an IP based on a cookie.
    – Frank Thomas
    Commented Jun 14 at 20:34
  • I have no idea about the server config, I do not have access. My only access is to my page, PHP, .htaccess, and the Apache log. How can I access the proxy then? BTW, my page is hosted by Oracle.
    – Luis A. Florit
    Commented Jun 14 at 20:39
  • I'm afraid you will have to contact them then. that the source IP of request traffic is all the same (or a handful) of oracle IP addresses, then you cannot tell which request is which IP at the apache level. good luck.
    – Frank Thomas
    Commented Jun 14 at 21:07
  • I see. What is funny is that I can see the external IP in the logs... but I understand that I have no tools after the log.
    – Luis A. Florit
    Commented Jun 14 at 21:16
  • I added Deny from 201.17.83.xxx, and it did not work. Yet, Deny from 10.0.1.xxx worked, but of course is not reliable since Oracle keep changing the inner IP with each request. So .htaccess only (seems to) see the internal IP. Maybe there is some other directive to access the original IP?
    – Luis A. Florit
    Commented Jun 14 at 21:23

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .