Re: ufw help
Jim Kinney via Ale <[email protected]> Sun, 5 Apr 2026 18:32:31 -0400
| Newsgroups | gmane.org.user-groups.ale |
|---|---|
| Message-ID | <CAEo=5Pyyg=xz-PWaN51g4S6Zpnzn7ds4MUZWe+quBk+x6BLY+Q@mail.gmail.com> |
--===============7696942285814378325== Content-Type: multipart/alternative; boundary="0000000000000238ea064ebe2144" --0000000000000238ea064ebe2144 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ha! Don't block 'em. Set up a forwarding proxy with a "permanently moved" and send them all back to facebook addresses. =F0=9F=96=95 --=20 James P. Kinney III Every time you stop a school, you will have to build a jail. What you gain at one end you lose at the other. It's like feeding a dog on his own tail. It won't fatten the dog. - Speech 11/23/1900 Mark Twain *http://heretothereideas.blogspot.com/ <http://heretothereideas.blogspot.com/>* On Sun, Apr 5, 2026, 2:52=E2=80=AFPM lollipopman691 via Ale <[email protected]> w= rote: > In recent days facebook's crawlers ( or someone impersonating them) have > been hammering my website hard enough to bring it to its knees. > The hits all seem to originate from addresses in 57.141.0.0/32, which > iplocation.net puts in Ashburn,VA and owned by facebook//meta. > > Here's an example of a hit from /var/log/apache2/other_vhosts_access.log: > > tomshiro.org:443 57.141.0.50 - - [05/Apr/2026:14:26:23 -0400] "GET > /foswiki/bin/edit/System/WebSearch?t=3D1775413530 HTTP/1.1" 504 2571 "-" > "meta-webindexer/1.1 (+ > https://developers.facebook.com/docs/sharing/webmasters/crawler)" > > I am getting a *massive* number of these. My (crude) weblog analyzer list= s > 9515 of them between midnight and 2 pm, many of them in bursts less than = a > second apart. > > So I have attempted to ban that ip address through ufw, using the command > "ufw deny from 57.141.0.0/32" . Here's the output from "ufw status > numbered: > > Status: active > > To Action From > -- ------ ---- > [ 1] 25/tcp ALLOW IN Anywhere > [ 2] 22/tcp ALLOW IN Anywhere > [ 3] Anywhere DENY IN 146.174.0.0/16 > [ 4] Anywhere DENY IN 185.171.0.0/16 > [ 5] Anywhere DENY IN 20.171.207.109 > [ 6] Anywhere DENY IN 202.76.0.0/16 > [ 7] Anywhere DENY IN 212.52.0.0/16 > [ 8] Anywhere DENY IN 216.73.216.125 > [ 9] Anywhere DENY IN 47.238.0.0/16 > [10] Anywhere DENY IN 47.239.0.0/16 > [11] Anywhere DENY IN 47.242.0.0/16 > [12] Anywhere DENY IN 47.243.0.0/16 > [13] Anywhere DENY IN 47.76.0.0/16 > [14] Anywhere DENY IN 8.210.0.0/16 > [15] Anywhere DENY IN 8.218.0.0/16 > [16] Anywhere DENY IN 45.206.0.0 > [17] Anywhere DENY IN 47.128.0.0 > [18] Anywhere DENY IN 57.141.0.0 > [19] 80 (v6) ALLOW IN Anywhere (v6) > [20] 443 (v6) ALLOW IN Anywhere (v6) > [21] 25/tcp (v6) ALLOW IN Anywhere (v6) > [22] 22/tcp (v6) ALLOW IN Anywhere (v6) > > > > You can see the ban rule in line 18, above. > > Theoretically this should stop these hits, yes? Or should I be saying "uf= w > deny from 57.141.0.0/16" ? > > This is on a pretty much stock Debian 12 server running on aws ec2, FWIW. > > -- CHS > > > > > _______________________________________________ > Ale mailing list > [email protected] > https://mail.ale.org/mailman/listinfo/ale > See JOBS, ANNOUNCE and SCHOOLS lists at > http://mail.ale.org/mailman/listinfo > --0000000000000238ea064ebe2144 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div>Ha! Don't block 'em. Set up a forwarding pro= xy with a "permanently moved" and send them all back to facebook = addresses. =F0=9F=96=95</div><div><br></div><div data-smartmail=3D"gmail_si= gnature"><div dir=3D"ltr">-- <br>James P. Kinney III<br><i><i><i><i><br></i= ></i></i></i>Every time you stop a school, you will have to build a jail. W= hat you=20 gain at one end you lose at the other. It's like feeding a dog = on his=20 own tail. It won't fatten the dog.<br> - Speech 11/23/1900 Mark Twain<br><i><i><i><i><br><a href=3D"http:/= /heretothereideas.blogspot.com/" target=3D"_blank">http://heretothereideas.= blogspot.com/</a><br></i></i></i></i></div></div></div><br><div class=3D"gm= ail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On S= un, Apr 5, 2026, 2:52=E2=80=AFPM lollipopman691 via Ale <<a href=3D"mail= to:[email protected]">[email protected]</a>> wrote:<br></div><blockquote class=3D"gm= ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le= ft:1ex">In recent days facebook's crawlers ( or someone impersonating t= hem) have been hammering my website hard enough to bring it to its knees.<b= r> The hits all seem to originate from addresses in <a href=3D"http://57.141.0= .0/32" rel=3D"noreferrer noreferrer" target=3D"_blank">57.141.0.0/32</a>, w= hich <a href=3D"http://iplocation.net" rel=3D"noreferrer noreferrer" target= =3D"_blank">iplocation.net</a> puts in Ashburn,VA and owned by facebook//me= ta.<br> <br> Here's an example of a hit from /var/log/apache2/other_vhosts_access.lo= g:<br> <br> <a href=3D"http://tomshiro.org:443" rel=3D"noreferrer noreferrer" target=3D= "_blank">tomshiro.org:443</a> 57.141.0.50 - - [05/Apr/2026:14:26:23 -0400] = "GET /foswiki/bin/edit/System/WebSearch?t=3D1775413530 HTTP/1.1" = 504 2571 "-" "meta-webindexer/1.1 (+<a href=3D"https://devel= opers.facebook.com/docs/sharing/webmasters/crawler" rel=3D"noreferrer noref= errer" target=3D"_blank">https://developers.facebook.com/docs/sharing/webma= sters/crawler</a>)"<br> <br> I am getting a *massive* number of these. My (crude) weblog analyzer lists = 9515 of them between midnight and 2 pm, many of them in bursts less than a = second apart.<br> <br> So I have attempted to ban that ip address through ufw, using the command &= quot;ufw deny from <a href=3D"http://57.141.0.0/32" rel=3D"noreferrer noref= errer" target=3D"_blank">57.141.0.0/32</a>" .=C2=A0 Here's the out= put from "ufw status numbered:<br> <br> Status: active<br> <br> =C2=A0 =C2=A0 =C2=A0To=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Action=C2=A0 =C2=A0 =C2=A0 From<br> =C2=A0 =C2=A0 =C2=A0--=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0------=C2=A0 =C2=A0 =C2=A0 ----<br> [ 1] 25/tcp=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0ALLOW IN=C2=A0 =C2=A0 Anywhere<br> [ 2] 22/tcp=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0ALLOW IN=C2=A0 =C2=A0 Anywhere<br> [ 3] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://146.174.0.0/16" rel=3D"= noreferrer noreferrer" target=3D"_blank">146.174.0.0/16</a><br> [ 4] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://185.171.0.0/16" rel=3D"= noreferrer noreferrer" target=3D"_blank">185.171.0.0/16</a><br> [ 5] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A020.171.207.109<br> [ 6] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://202.76.0.0/16" rel=3D"n= oreferrer noreferrer" target=3D"_blank">202.76.0.0/16</a><br> [ 7] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://212.52.0.0/16" rel=3D"n= oreferrer noreferrer" target=3D"_blank">212.52.0.0/16</a><br> [ 8] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0216.73.216.125<br> [ 9] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://47.238.0.0/16" rel=3D"n= oreferrer noreferrer" target=3D"_blank">47.238.0.0/16</a><br> [10] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://47.239.0.0/16" rel=3D"n= oreferrer noreferrer" target=3D"_blank">47.239.0.0/16</a><br> [11] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://47.242.0.0/16" rel=3D"n= oreferrer noreferrer" target=3D"_blank">47.242.0.0/16</a><br> [12] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://47.243.0.0/16" rel=3D"n= oreferrer noreferrer" target=3D"_blank">47.243.0.0/16</a><br> [13] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://47.76.0.0/16" rel=3D"no= referrer noreferrer" target=3D"_blank">47.76.0.0/16</a><br> [14] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://8.210.0.0/16" rel=3D"no= referrer noreferrer" target=3D"_blank">8.210.0.0/16</a><br> [15] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A0<a href=3D"http://8.218.0.0/16" rel=3D"no= referrer noreferrer" target=3D"_blank">8.218.0.0/16</a><br> [16] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A045.206.0.0<br> [17] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A047.128.0.0<br> [18] Anywhere=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0DENY IN=C2=A0 =C2=A0 =C2=A057.141.0.0<br> [19] 80 (v6)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 ALLOW IN=C2=A0 =C2=A0 Anywhere (v6)<br> [20] 443 (v6)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0ALLOW IN=C2=A0 =C2=A0 Anywhere (v6)<br> [21] 25/tcp (v6)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ALL= OW IN=C2=A0 =C2=A0 Anywhere (v6)<br> [22] 22/tcp (v6)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ALL= OW IN=C2=A0 =C2=A0 Anywhere (v6)<br> <br> <br> <br> You can see the ban rule in line 18, above. <br> <br> Theoretically this should stop these hits, yes? Or should I be saying "= ;ufw deny from <a href=3D"http://57.141.0.0/16" rel=3D"noreferrer noreferre= r" target=3D"_blank">57.141.0.0/16</a>" ?<br> <br> This is on a pretty much stock Debian 12 server running on aws ec2, FWIW.<b= r> <br> -- CHS<br> <br> <br> <br> <br> _______________________________________________<br> Ale mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"noreferrer">Ale@ale= .org</a><br> <a href=3D"https://mail.ale.org/mailman/listinfo/ale" rel=3D"noreferrer nor= eferrer" target=3D"_blank">https://mail.ale.org/mailman/listinfo/ale</a><br= > See JOBS, ANNOUNCE and SCHOOLS lists at<br> <a href=3D"http://mail.ale.org/mailman/listinfo" rel=3D"noreferrer noreferr= er" target=3D"_blank">http://mail.ale.org/mailman/listinfo</a><br> </blockquote></div> --0000000000000238ea064ebe2144-- --===============7696942285814378325== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ale mailing list [email protected] https://mail.ale.org/mailman/listinfo/ale See JOBS, ANNOUNCE and SCHOOLS lists at http://mail.ale.org/mailman/listinfo --===============7696942285814378325==--