How do I block clusters of IP addresses?

Question: How do I block clusters of IP addresses?

Answer: Although we previously illustrated a method of blocking single IP addresses using an .htaccess file, it is important to know a few things.

1. Many hackers use proxies and other methods to use fake IP addresses. Blocking the one they have faked might actually block a legitimate user.

2. Even if you do have the right IP address for the right attacker, there is no guarantee they will continue to use that address, as it might be dynamic.

3. An attacker may use a cluster of IP addresses to initiate an attack (i.e. 66.328.203.000), but blocking an entire range of IP addresses, particularly ones that could point to home routers, will inevitably also block potential users.

The other option is to rely on hostnames rather than IP addresses. The problem with hostnames is that these too can be forged. That only leaves one real option, the option that should take precedence anyway. Secure your server to make it as difficult as possible for attackers to get in, and even if they do get in, make it difficult for them to do damage. Most will give up if doing damage takes to long or if their automated attack bots fail. Make your firewall airtight, install application firewalls like Modsecurity, and make it impossible for an outsider to gain root access.

Photo Source: Flickr