1 前言

一个问题，一篇文章，一出故事。
笔者今天查看Nginx错误日志，发现大量的如下日志，

2026/08/31 12:57:32 [error] 1081#1081: *355325 limiting requests, excess: 5.011 by zone "www.cmdschool.org_req", client: 35.185.163.89, server: www.cmdschool.org, request: "GET /application_default_credentials.json HTTP/1.1", host: "www.cmdschool.org"
2026/08/31 12:57:33 [error] 1081#1081: *355325 limiting requests, excess: 5.035 by zone "www.cmdschool.org_req", client: 35.185.163.89, server: www.cmdschool.org, request: "GET /keyfile.json HTTP/1.1", host: "www.cmdschool.org"
2026/08/31 12:57:33 [error] 1081#1081: *355325 limiting requests, excess: 5.017 by zone "www.cmdschool.org_req", client: 35.185.163.89, server: www.cmdschool.org, request: "GET /firebase-adminsdk.json HTTP/1.1", host: "www.cmdschool.org"

从日志判断，这属于CC攻击

如何配置Nginx防止CC攻击？

2 最佳实践

2.1 环境配置

如何安装部署fail2ban基础环境？

2.2 配置Fail2Ban

2.2.1 创建过滤规则

vim /etc/fail2ban/filter.d/nginx-cc.conf

加入如下配置，

[Definition]
failregex = ^.*limiting requests, excess.*client: <HOST>.*$

然后，你可以使用如下命令来确认规则，

fail2ban-regex --print-all-matched /var/log/nginx/error.log /etc/fail2ban/filter.d/nginx-cc.conf

2.2.2 定义监视配置

vim /etc/fail2ban/jail.d/nginx-cc.local

加入如下配置，

[nginx-cc]
enabled = true
port = http,https
filter = nginx-cc
logpath = /var/log/nginx/error.log
maxretry = 3
findtime = 5m
bantime = 24h

配置修改后，你需要重启服务使配置生效，

systemctl restart fail2ban.service
systemctl status fail2ban.service

2.2.3 查看服务状态

fail2ban-client status nginx-cc

可见如下显示，

Status for the jail: nginx-cc
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     3
|  `- File list:        /var/log/nginx/error.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   20.220.211.172

2.2.4 查看防火墙状态

iptables -L -v -n

可见如下显示，

#...
Chain f2b-nginx-cc (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  164  8642 REJECT     all  --  *      *       20.220.211.172       0.0.0.0/0            reject-with icmp-port-unreachable
73937  220M RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0  

参阅文档
====================
https://github.com/fail2ban/fail2ban/wiki/Developing-Regex-in-Fail2ban
https://wangdoc.com/ssh/fail2ban