linux - DDOS mod Rewrite IP Request -

we're receiving ddos attack specific range of ips (192.168.0-255.0-255). in our htaccess file we've attempted forward requests static html file half requests being blocked. see why be?

rewritecond %{remote_addr} ^(10\.0\.0\.1|192\.168\.[0-9]{0,3}\.[0-9]{0,3})$ rewritecond %{request_uri} [^/etc/blocked_ip.html] rewriterule ^(.*)$ /etc/blocked_ip.html [r=301,l] 

and our access logs show:

2014-06-27 11:59:03 192.168.20.232 - 1.2.3.4 443 /etc/blocked_ip.html ? 2014-06-27 11:59:08 192.168.20.231 - 1.2.3.4 443 /video/832 

note: i've substituted actual ip ranges private ranges.

thanks suggestions.

actually rewrite condition incorrect:

rewritecond %{request_uri} [^/etc/blocked_ip.html] 

probably meant:

rewritecond %{request_uri} !^/etc/blocked_ip\.html 

you rule can shortened to:

rewritecond %{remote_addr} ^(10\.0\.0\.1|192\.168\.[0-9]{1,3}\.[0-9]{1,3})$ rewriterule !^etc/blocked_ip\.html$ /etc/blocked_ip.html [r=301,l,nc] 

also make sure first rule in .htaccess.