Is your web server facing a recent country-based attack?

One of the best methods to prevent such attacks is to block a country using ModSecurity Rule.

The ModSecurity application firewall uses special security rules to prevent unauthorized website access.

At Bobcares, we often receive requests to block the country/domain with the ModSecurity rule as a part of our Server Management Services.

So, let’s discuss different ways that our Support Engineers use to Block Country using the ModSecurity Rules.

What is ModSecurity Rule?

As the first step, let’s check some information on ModSecurity as such.

ModSecurity is a web-based firewall (or WAF) application supported by popular Web servers like Apache, Nginx, LiteSpeed, etc.

From our experience in managing servers, we see that ModSecurity installed servers easily defends 80% of web application-level attacks. Additionally, it protects against web attacks and enables HTTP traffic monitoring.

How to identify a country-based attack?

When your website is under attack, the first step is to identify whether it is a country-based attack or not. Let’s now see how our Security Engineers isolate cases of attack from a particular country.

1. Grab details of IP address connections on port 80

We begin by checking the count of the IP address which is having a concurrent connection to the webserver. Here, netstat command comes to the rescue.

A sample set of results when the server is under attack appear as:

56 74.xx.169.xx
26 7x.xx.176.xx
17 7y.xx.50.6
7 91.xx.xx.106

Here, the HTTP server had 56 connections from the IP 74.xx.169.xx.

2. Identifying the status of the connection

The very next step is to check the stat of the IP address connection. Again, netstat comes to rescue here too. Our Security Engineers check the IP address having a maximum number of connections to port 80 or 443.

The below netstat result is a proper indication of the attack on the server.

15 CLOSE_WAIT
37 LAST_ACK
64 FIN_WAIT_1
65 FIN_WAIT_2
1251 TIME_WAIT
3597 SYN_SENT
5124 ESTABLISHED

3. Find the IP location details

Furthermore, we make use of scripts based on ipAPI service that will help us to find IP location and organization.

In the majority of the attacks, the access will be from a wide range of IP addresses. However, some amateur attackers use cherry-picked methods to launch attacks from specific regions of the planet. That is where the blocking of IP addresses based on country works.

Moreover, advanced hackers can easily spoof or mask the location of the IP address. As a result, the country based block may not be effective in all scenarios. Thus if the website has only visitors from a specific region, it’s worth limiting access to a smaller region.

Different ways to Block Country using ModSecurity Rule

Till now we saw how we find more details about the attack. Let’s now check on how our Support Engineers write the custom ModSecurity Rules for our customers to mitigate the attack.

Initially, we create a new ModSecurity custom rules file:

nano /etc/modsecurity/modsecurity_custom_rules.conf

1. Domain blocking with one country.

To block a specific country, we add the following rules in the custom configuration file.

SecRule REMOTE_ADDR "@geoLookup" "phase:1,chain,id:10,drop,log,msg:'Blocking Country IP Address'"
SecRule GEO:COUNTRY_CODE "@pm XX" chain
SecRule SERVER_NAME "thedomain.com"

set thedomain.com = your website name
XX = Country code

2. Domain blocking with more than one country.

Similarly, when we have to block more than one country, we use the below rule set.

SecRule REMOTE_ADDR "@geoLookup" "phase:1,chain,id:10,drop,log,msg:'Blocking Country IP Address'"
SecRule GEO:COUNTRY_CODE "@pm C1 C2 C3" chain
SecRule SERVER_NAME "thedomain.com

C1, C2 and C3 =  two-character country code for a country you want to block.

How to Block Country using ModSecurity Rule in WHM.

Fortunately, control panel based servers give an easier way to implement the ModSecurity rules. For instance, let’s check the steps to do this in a cPanel server.

1. Log into the WHM.

2. Go Security Center -> ModSecurity Tools -> Rules List -> Add Rule.

3. Paste the edited rule in the Rule Text box.

4. Check the box for “Deploy and Restart Apache”.

5. Click “Save”.

That’s it. The rule is now in place and starts blocking the connections to the webserver.

[Need assistance to add the ModSecurity rules on your server? We’ll help you.]

Conclusion

In a nutshell, block country using ModSecurity Rule is a quick way to mitigate web server attacks. Today’s write-up discussed how our Support Engineers add ModSecurity rules in different ways and prevent unauthorized website attacks.