[Bender]

I would be interested in some examples of valid traffic that they would block. For the purposes of the document I do not consider anything from a data-center to be valid traffic. People can of course skip any or all steps, experiment with one at a time on a test server as they should.

[ferngodfather]

> Obvious proxy is obvious.

> if ($http_x_forwarded_for) {....

This may block schools and libraries that use content blockers. Often the internal client is left to make abuse tracking easier (or because the overworked admin didn't know they could turn it off).

[Bender]

This may block schools and libraries

Oh, well that is ok for me I suppose. I add RTA/adult headers that hopefully they also look for and block using parental controls as adult content should not be viewed in a school or library. I could add a note suggesting to skip that step if one wishes schools and libraries that may be using a proxy to view.

[ferngodfather]

That's fair enough.

I think it's a great article to be fair. We need more of this cheap and quick bot blocking. The fact the solution to unwanted traffic is often "use Cloudflare" is _not_ great for the internet, and nobody really actually likes deploying or managing ModSecurity. Its a nice middleground.

[inigyou]

Cheap and quick bot-blocking is provided by go-away, less cheap and quick by Anubis.

[aorth]

Sadly, go-away https://git.gammaspectra.live/git/go-away doesn't seem to be maintained anymore.

[iririririr]

both of these are easily bypassed by bots.

security theater at its finest. not to mention wasteful.

[ferngodfather]

It's not "security theatre", it's blocking the absolute worst, most painfully obvious bots that. These bots also happen to account for a good 85% of bot traffic, so it makes sense to block them.

Yes, of course, if a real threat actor is doing things properly they'll be using residential proxies and legitimate user agents, but we're talking here about blocking "some of the bots" - mainly the script kiddies.

[inigyou]

At this point you may as well define who you want to allow instead of defining who you want to block.

[inigyou]

okay yeah well if you redefine all valid traffic that you block to be invalid traffic then I guess you don't block any valid traffic, congrats

[ACCount37]

VPN exits often "come from datacenters". And there are entire countries where the web can be unusable without.

If you don't have LaLiga in your country, that doesn't mean everyone is so lucky. Blanket IP range bans, in this day and age? Basically a proclamation of incompetence.

[Bender]

Basically a proclamation of incompetence.

I understand your frustration. Normally a blog site would not have any or many of these measures enabled. This is more of a test site to show what could be done on any other type of site. People can pick and choose which methods to use. Some may wish to block VPNs and proxies especially on forums.

I should make an article that shows additional ways to detect VPN's, including residential.

[ferngodfather]

> Blanket IP range bans, in this day and age? Basically a proclamation of incompetence.

I disagree. If I'm getting problematic traffic from even a few of your IPs and they're in a DC/VPS range, I'm blocking it and moving on with my day.

But I suppose none of my clients services typically ever need to be accessible from such countries anyway.

[inigyou]

Temporary blocks on specific IPs where abuse is actually seen: okay

Permanently blocking every IP that some random guy didn't label as residential: bad