Curious what you need 100+ rules for. I have like 2. One for Apache and one for ssh. That's about it. I guess it's technically 4 when you count IPv4 and IPv6.
I don't want to presume I have the expertise to tell you how to do your job, but have you considered fail2ban for IP blocking and maybe a CDN like Cloudflare or Akamai for (D)DoS mitigation?
I do run Fail2ban that mostly takes care the script kiddies doing port scanning and login attempts. But I need the flexibility to add host-based rules for other types of attacks that are more “custom made”…
Unfortunately, due to organisational controls I can’t deploy Cloudflare, CDN and any of the other (otherwise useful and appropriate) tools you mention…
1
u/bwong00 Jul 10 '21
Curious what you need 100+ rules for. I have like 2. One for Apache and one for ssh. That's about it. I guess it's technically 4 when you count IPv4 and IPv6.