Nginx Nginx Simple Config to Combat Layer 7 DDOS Attack

Checking a few days ago using https the connections/requests limit and was not working as expected....

When i was load the main index page of the forum not all icons in front of each category load

I thought as i have done many times with no issues that my numbers was small so just for a test i increase connections to 20 and requests to 200 with the same result

It was the first time that this setting cause me an issue and it wasthe first time that i had use Let's encrypt on that server ....

So maybe is related to https?

 

But more than 20 and 200 ?

I thought that htt2 was able to get more content with fewer connections....

 

Checking the above info then there is an issue for limiting connections and requests as 20 connections and 200 requests that i set are huge values and it didn't work

 

I do not use on that server Cloudflare at all....

 

i'm searching for a way to fight botnet and malicious ips
beside csf, cloudflare , find this but i have not tested yet

vDDoS, a HTTP(S) DDoS Protection
website vDDoS Proxy Protection


feature for security
variable: no, 307, 200, click, 5s, high, captcha
Sets a valid for Security Level Protection. Note: no < 307 < 200 < click < 5s < high < captcha


system requirement

• CentOS Server 5/6/7 x86_64 (http://centos.org)
• CloudLinux Server 5/6/7 x86_64 (http://cloudlinux.com)

 

other tool to monitor real time incoming connection to port 80, 443,22,..
beside netstat , lsof -i ,ss -ant ,
my favorite is iptraf-ng
for setup just type

Code:

yum install iptraf-ng

and using this tool just type in ssh

Code:

iptraf-ng -i eth0

copy paste the result to site below for any suspicious ip
AbuseIPDB - IP address abuse reports - Making the Internet safer, one IP at a time
IBM X-Force Exchange

How to exclude LAN traffic with iptraf-ng?

 

From my experience if you are under a Ddos attack you will not be able to ssh on the server at all.....

So you have to block everything before your server....

 

Didn't notice that was specific for layer 7

Yup you are right i was talking about layer 3/4 attacks.....

 

the other way to reduce attack to all port
just testing iptables drop from javapipe iptable ddos protection
might need adjustment

first create csfpre.sh

Code:

$ nano -w /usr/local/csf/bin/csfpre.sh
insert this line

### 1: Drop invalid packets ###
/sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP

### 2: Drop TCP packets that are new and are not SYN ###
/sbin/iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

### 3: Drop SYN packets with suspicious MSS value ###
/sbin/iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

### 4: Block packets with bogus TCP flags ###
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
/sbin/iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

### 5: Block spoofed packets ###
#/sbin/iptables -t mangle -A PREROUTING -s 224.0.0.0/3 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 169.254.0.0/16 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 172.16.0.0/12 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 192.168.0.0/16 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 0.0.0.0/8 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 240.0.0.0/5 -j DROP
#/sbin/iptables -t mangle -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP

### 6: Drop ICMP (you usually don't need this protocol) ###
#/sbin/iptables -t mangle -A PREROUTING -p icmp -j DROP

### 7: Drop fragments in all chains ###
#/sbin/iptables -t mangle -A PREROUTING -f -j DROP

### 8: Limit connections per source IP ###
#/sbin/iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset

### 9: Limit RST packets ###
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP

### 10: Limit new TCP connections per second per source IP ###
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 20 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m conntrack --ctstate NEW -j DROP

### 11: Use SYNPROXY on all ports (disables connection limiting rule) ###
#/sbin/iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack
#/sbin/iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
#/sbin/iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

### SSH brute-force protection ###
#/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
#/sbin/iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

### Protection against port scanning ###
/sbin/iptables -N port-scanning
/sbin/iptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN
/sbin/iptables -A port-scanning -j DROP

###save before quit

$ chmod +x /usr/local/csf/bin/csfpre.sh
$ csf -r | more
or reboot

so far no trouble with kvm vps or csf and centminmod nginx stack

website
CSF *Port Scan* detected - shared hosting
https://download.configserver.com/csf/readme.txt
How to Add Custom iptables Rules with CSF - TecAdmin.net
DDoS Protection With IPtables: The Ultimate Guide