Knowledgebase
Block outgoing ip..
| Posted by -liquid-, 05-03-2015, 03:15 PM | | Hello.. i have a VPS and it makes outgoing connections to an ip .. the VPS has Centos 6 64 with csf .. how i can block the outgoing ip so my VPS ip not make connection to it..???
|
| Posted by PlatinumVPS, 05-04-2015, 02:07 AM | | If you have cPanel/WHM in your VPS then you can follow below steps and block an IP address:
[1] Log in to WHM
[2] Search for firewall
[3] Click on Firewall Deny IPs button
[4] Add an IP address in this list with proper comment
[5] Save the changes and restart csf service
If you do not have cPanel/WHM in your VPS then you can do this from command line. Following link will give you basic CSF command information:
https://raymii.org/s/articles/Config...y_CSF_LFD.html
|
| Posted by -liquid-, 05-04-2015, 01:12 PM | | I think this is for ingoing connections you wrote..
|
| Posted by JustinAY, 05-05-2015, 01:12 AM | | You can use /etc/csf/csf.deny to block the activity.
The question is, why is your VPS doing this? There is probably a much larger issue. What information do you have on this/how did you find this out? It would be better if we fixed the overall issue versus putting a band-aid on t.
|
| Posted by hostcurator, 05-05-2015, 10:06 AM | | Hi Liquid,
You have to check all the process in your server in detail and make sure no suspicious/malicious scripts are running. Most probably malicious scripts or suspicious process will cause these high outgoing packets issue. You have to contact the help of your system admin at the earliest.
|
| Posted by SneakySysadmin, 05-05-2015, 10:21 AM | | The absolute fastest way to block connections to or from an IP from the command line at 3am when you're barely awake and some testicularly challenged adolescent is hammering your server...
Now your server can't have any conversations with that evil W.X.Y.Z IP address as any time a packet comes in or goes out your server is routing it off into the black hole that is the 'localhost' device. You now have breathing room to find the compromised script or whatever that's trying to talk to it. Keep in mind it doesn't stop the traffic - just prevents your server from successfully exchanging traffic with that IP.
And going to parrot what the others have already said - if your server is trying to connect to some outside IP and you don't want it to do that you need to find what is doing it and fix that. Simply blocking the IP is a band-aid, not a permanent solution.
Last edited by SneakySysadmin; 05-05-2015 at 10:26 AM.
|
|
 Add to Favourites
 Print this Article
|
Also Read
