Best practices for blocking abusive IPs

[inomi13]

I would like to know how are you fighting with many connections which come from IP addresses that are being abused. I spend lots of time to find solution but it isn't easy. I tried to set limit connections in CSF.

I tried to added limit connection in ModSecurity for good bots crawler but after that Google didn't index pages and show information "Please note: Not all unblock requests will be successful as it is dependent on how your IP address is being blocked. If the unblock fails you will need to ..." so I remove this configuration. Good way was set custom configuration in ModSecurity to refuse connections for bad bots and it works.

Below I describe my configuration and I will be very grateful to share your opinion about this case.

CSF:

CT_LIMIT= 300
CT_INTERVAL= 30
CONNLIMIT= 80;20,443;30
PORTFLOOD = 80;tcp;100;60,443;tcp;100;60

Modescurity:

SecRule REQUEST_HEADERS:User-Agent \
"@pmFromFile bad_bots_list.txt" \
"id:1100000,\
phase:2,\
t:none,\
t:lowercase,\
log,\
deny,\
status:406,\
severity:2,\
msg:'Custom WAF Rules: WEB CRAWLER/BAD BOT'"