OVH: how to block an IP address on your server when you are behind an IPLB

>Hello World ;) If you use or manage infrastructure or dedicated servers from OVH, you are probably familiar with that excellent, ready-to-use and inexpensive infrastructure component (€9.99 excluding VAT per month), the IPLB (IP Load Balancer). Imagine a ready-to-use HAProxy accessible through a very easy-to-use interface (the OVH manager) or directly through the API: that is the IPLB. It makes it very easy to set up active load balancing (load distribution), passive load balancing (backup/disaster recovery mode if a machine fails), or a combination of both modes, with pretty much all the fine-grained control you could hope for in such a product.

The only limitation: you can currently connect 16 backends to your OVH IPLB, whether web, TCP or UDP, which is already quite enough to work on “serious” infrastructure. One final limitation: IPs routed through vRack cannot yet be used as backends, but that is being implemented!

To learn more about the IPLB, I recommend the following video: short, simple and effective:

Watch the video on YouTube

The usual problem when using a load balancer is that you cannot see the IPs of visitors connecting to your server: the load balancer’s private IP address is what appears instead, as it does when you use a service such as CloudFlare.

However, you can configure this service through the OVH API to use the proxypass feature, which still lets you recover the IP address from the HTTP request received by your server.

However, if you try to blacklist an IP address directly on your machine through iptables, for example like this:

iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP -v

, it will not work, because that address *is not* connected to your server.

If you need to block a particular attack on your website, such as an application-layer DDoS attack not handled by VAC (OVH’s network Anti-DDoS system), the solution is to match the packet’s contents directly to block the attacker as follows:

iptables -I INPUT 1 -p tcp --dport 80 -m string --algo bm --string "X-Forwarded-For: xxx.xxx.xxx.xxx" -j LOG_DROP

You can also create a small script to make the syntax easier to use day to day:

#!/bin/sh
iptables -I INPUT 1 -p tcp --dport 80 -m string --algo bm --string "X-Forwarded-For: $1" -j DROP

Now simply use

./yourscript.sh xxx.xxx.xxx.xxx

to blacklist an address, or

|xargs -l ./yourscript

to apply it automatically to a list of addresses. Be careful, though: this method has a limitation. It does not work over an HTTPS connection; since the IP address is, by definition, inside the HTTPS request here, iptables cannot decode it on the fly. The solution is then to use the API to enable firewall features on the IP address carried by your IPLB: that will be the subject of a future test. Another solution might be to assign an IPFO (IP FailOver) to the IPLB, allowing OVH’s firewall features to be used as with a standard IP address, either through the manager or through the API. Another possibility I still need to test.

Need managed services for your Linux server, VPS or public cloud? Email: sales@digital-netcom.com

Christophe Casalegno
You can follow me on: Twitter | Facebook | Linkedin | Telegram | Youtube

OVH: how to block an IP address on your server when you are behind an IPLB

Leave a comment