Discussion
The number of daily HTTP requests my iocaine serves is up from ~3M to ~6.7M.
Or my stats are wrong.... my stats might be wrong, because it doesn't really add up. Will have to have a look tomorrow.
However, what I do see is that the generated-url ruleset gets a lot more hits since about 13h yesterday. Those are firewalled off after one request, so the increased rate suggests they're coming at me from considerably more IPs.
❯ doas nft -t list table inet iocaine | grep count
size 10000000 # count 646215
size 10000000 # count 2387805
ip saddr @blocks_v4 counter packets 57656622 bytes 3457597783 drop
ip6 saddr @blocks_v6 counter packets 5489016 bytes 439545330 drop
That's a whole lot of IPv6 addresses. Looking at the logs of the past 6 hours, there have been 1.88m IPv6 addresses hitting that ruleset, and 682k IPv4 ones, so... this kinda tracks.
Not sure what I can do at this time (I don't need to, not yet). I can't block IPv6 ranges until I replace the firewalling code again.
Install bonfire.cafe
Get the full app experience