BorlandTalk.com

Richard Bakos · Guest

We have grown weary of filtering unwanted IP address ranges in IIS so
I'm thinking about writing a filter that compares the value of
Request.RemoteAddr to a large (20,000+?) list of classful IP addresses.
The filter would return a status code 404, or something much less
friendly. :-)

The idea is to load classful lists into the filter from files maintained
through places like this -

http://www.blackholes.us/zones/countries/

This will allow us to easily block entire countries. It's our
observation that if we can block all incoming requests from China, we'd
drastically reduce the amount of attacks against our public sites.

What is the most efficient (fastest) way for me to accomplish partial
string matching in a case like this?

Maybe a better question - Is there a filter out there that already
accomplishes what I want to do? I couldn't find anything in my search.

Is there a better way to handle this altogether?

Thanks,

Rich Bakos

Del Murray · Guest

Rich,

Wouldn't this be better handled at the firewall ? It would sure take a load
off the server.
You can dump your firewall config to a flat file, (ususally .. like on my
Cisco), and reload it from there. That being the case, you could then have
an app that updates a DB with rogue IPs and then automatically builds the
firewall input file. The drawback is, that updating the firewall would
probably be a manual step since logging in to them is usually pretty secure
and wouldn't allow a .Bat file or script to run against it.

Del

Richard Bakos · Guest

Del Murray wrote:

Hi Del,

Del Murray · Guest

Got it. Actually, something like what you propose would help me too so
maybe I can figure something out and pass it on to you.

Del