I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know if this is only for drupal or is it adding it to the OS as well. Also once I block an IP address what do the attackers see? Do they get a 404? Do they get a banned message? or nothing at all? If this is not also adding to the server OS IP block is there a module that will?
They see a blank 403 page with this message specifying that their IP address has been banned:
The block is done at the application level. Drupal inserts a record into the
blocked_ips table which is referenced upon bootstrapping; if a match is found the above page is shown.
I've not heard a module that does this at the OS level. Considering the variety of environments it would have to accommodate, and the potential harm of giving an application OS-level blocking (e.g. Drupal blocking you could lock you out of your own server), it's likely it doesn't exist.