I map them every day.

A pentester here. Those bad looking requests are mostly random fuzzing by bots and sometimes from benign vulnerability scanners like Censys. If you keep your applications up date and credentials strong, there shouldn’t be much to worry about. Of course, you should review the risks and possible vulns of every web application and other services well before putting them up in the public. Search for general server hardening tips online if you’re unsure about your configuration hygiene.

An another question is, do you need to expose your services to the public? If they are purely private or for a small group of people, I’d recommend putting them behind a VPN. Wireguard is probably the easiest one to set up and so transparent you wouldn’t likely even notice it’s there while using it.

But if you really want to get rid of just those annoying requests, there’s really good tips already posted here.

Edit. Typos

Ignore them, as long as your firewall is set up properly.

sometimes I grab popcorn and “tail -f /var/log/secure”

I only expose services on IPv6, for now that seems to work pretty well - very few scanners (I encounter only 1 or 2 per week, and they seem to connect to port 80/443 only).

Anything exposed to the internet will get probed by malicious traffic looking for vulnerabilities. Best thing you can do is to lock down your server.

Here’s what I usually do:

• Install and configure fail2ban
• Configure SSH to only allow SSH keys
• Configure a firewall to only allow access to public services, if a service only needs to be accessible by you then whitelist your own IP. Alternatively install a VPN

Nothing too fancy other than following the recommended security practices. And to be aware of and regularly monitor the potential security holes of the servers/services I have open.

Even though semi-related, and commonly frowned upon by admins, I have unattended upgrades on my servers and my most of my services are auto-updated. If an update breaks a service, I guess its an opportunity to earn some more stripes.

I’m using BunkerWeb which is an Nginx reverse-proxy with hardening, ModSecurity WAF, rate-limiting and auto-banning out of the box.

Depends on what kind of service the malicious requests are hitting.

Fail2ban can be used for a wide range of services.

I don’t have a public facing service (except for a honeypot), but I’ve used fail2ban before on public ssh/webauth/openvpn endpoint.

For a blog, you might be well served by a WAF, I’ve used modsec before, not sure if there’s anything that’s newer.

I mean, it’s not a big deal to have crawlers and bots poking at our webserver if all you do is serving static pages (which is common for a blog).

Now if you run code on server side (eg using PHP or python), you’ll want to retrieve multiple known lists of bad actors to block them by default, and setup fail2ban to block those that went through. The most important thing however is to keep your server up to date at all times.

Fail2ban and Nginx Proxy Manager. Here’s a tutorial on getting started with Fail2ban:

https://github.com/yes-youcan/bitwarden-fail2ban-libressl

I stopped messing with port forwarding and reverse proxies and fail2ban and all the other stuff a long time ago.

Everything is accessible for login only locally, and then I add Tailscale (alternative would be ZeroTier) on top of it. Boom, done. Everything is seamless, I don’t have any random connection attempts clogging up my logging, and I’ve massively reduced my risk surface. Sure I’m not immune; if the app communicates on the internet, it must be regularly patched, and that I do my best to keep up with.

I use Caddy as a reverse proxy, but most of this should carry over to nginx. I used to use basic_auth at the proxy level, which worked fine(-ish) though it broke Kavita (because websockets don’t work with basic auth, go figure). I’ve since migrated to putting everything behind forward_auth/Authelia which is even more secure in some ways (2FA!) and even more painless, especially on my phone/tablet.

Sadly reverse proxy authentication doesn’t work with most apps (though it works with PWAs, even if they’re awkward about it sometimes), so I have an exception that allows Jellyfin through if it’s on a VPN/local network (I don’t have it installed on my phone anyway):

@notapp {
  not {
    header User-Agent *Jellyfin*
    remote_ip 192.160.0.0/24 192.168.1.0/24
  }
}
forward_auth @notapp authelia:9091 {
  uri /api/verify?rd=https://authelia.example
}

It’s nice being able to access everything from everywhere without needing to deal with VPNs on Android^ and not having to worry too much about security patching everything timely (just have to worry about Caddy + Authelia basically). Single sign on for those apps that support it is also a really nice touch.

^You can’t run multiple VPN tunnels at once without jailbreaking/rooting Android

I use ACL where I add my home/work IPs as well as a few commonly used VPNs IPs as well. Cloudflare clocks known bots for me. Don’t see anything in the server logs, but I do see attempts on the CF side.

I do client ssl verification.
Nobody but me or my household is supposed to access those anyway.
Any failure is a ban (I don’t remember how long for).
I also ban every IP not from my country, adjusting that sometimes if I travel internationally.
It’s much easier when you host stuff only for your devices (my case) and not for the larger public (like this lemmy instance).