/ Register

Welcome to Centmin Mod Community
Register Now

Nginx Nginx down when DDoS

Discussion in 'Nginx, PHP-FPM & MariaDB MySQL' started by Oxide, Apr 18, 2016.

Tags:
Previous Thread Next Thread
Loading...
Page 4 of 8
  1. May 2, 2016 #61
    Revenge

    Revenge Active Member

    469
    93
    28
    Feb 21, 2016
    Portugal
    Ratings:
    +354
    Local Time:
    8:24 AM
    1.9.x
    10.1.x
    @pamamolf im on the phone, but i'll give you my configuration when i get home. Basically, it bans every ip that makes a request using the WordPress user agent. Like @Oxide said, in very big attacks, the ip's making requests are faster than the ability of fail2ban to ban them. But it will ban all of them after some time.

    @Oxide another way to protect and if you have the money, is to buy the pro version of cloudflare that costs 20$. Their WAF protection will absorb the xmlrpc attack.
     
  2. May 2, 2016 #62
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    Yeah, but blocking user-agents should work fine (returning 444) however nginx goes down. Rather not spend a extra $20/m since something is wrong with centmin - before doing that i would start using VestaCP..

    I am having issues understanding what could prevent the requests from coming through? It's like something blocks it before nginx gets impacted.. Nginx never crash, never experienced such issue before.
     
  3. May 2, 2016 #63
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    5:24 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    you using 444 return status on both non-centmin mod and centmin mod nginx servers ? as that is exactly what 444 is meant to do = close nginx connections before nginx even responds to them
     
  4. May 2, 2016 #64
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    Correct. But that wouldn't block normal traffic too? And time out.. I have issues connecting to FTP for example, not sure if nginx/ftp is tied together.
     
  5. May 2, 2016 #65
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    5:24 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    nothing ties nginx and ftp so it's something else
     
  6. May 2, 2016 #66
    Revenge

    Revenge Active Member

    469
    93
    28
    Feb 21, 2016
    Portugal
    Ratings:
    +354
    Local Time:
    8:24 AM
    1.9.x
    10.1.x
    @Oxide if the attack is really big, the cpu will go anyway to 100%. That attack i received yesterday with 8000 servers making many requests per seconds each one of them, put each of the 8 cpu threads at 100%, even though nginx was returning 444 to them. Nginx will still receive those request
     
  7. May 2, 2016 #67
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    Yeah. I had issues connecting to FTP, couldn't connect at all during the attack. Neither any of my websites.. CPU? It used 0% CPU usage.

    On my other non-centmin server, where i only had nginx (No other services) 444 gave me 100% CPU Usage - but site didn't go down.
     
  8. May 2, 2016 #68
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    5:24 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    have you tried installing centmin mod 123.09beta01 ? or already tried ?
     
  9. May 2, 2016 #69
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    no, but i will try
     
  10. May 2, 2016 #70
    Ahmad

    Ahmad Active Member

    209
    80
    28
    Apr 13, 2015
    Ratings:
    +150
    Local Time:
    9:24 AM
    1.9.9
    10.1.10
    I added you on skype btw. @Oxide
     
  11. May 2, 2016 #71
    Revenge

    Revenge Active Member

    469
    93
    28
    Feb 21, 2016
    Portugal
    Ratings:
    +354
    Local Time:
    8:24 AM
    1.9.x
    10.1.x
    Filter:
    Code:
    [Definition]

failregex = ^<HOST> -.*WordPress.*/
    Jail:
    Code:
    [pingback]
enabled = true
port = http,https
filter = pingback
logpath = /path/to/your/access.log
backend  = polling
journalmatch =
maxretry = 1
findtime = 1
bantime = 86400
action = iptables-allports
     
  12. May 2, 2016 #72
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    This will not work with CloudFlare sadly.

    I used to use this: Redis based IP blacklist for Nginx (LUA) · GitHub

    It worked fine, redis is pretty quick.

    To be more specific, i used this to limit requests using fail2ban.. I limited php requests to 15 or so.
     
  13. May 2, 2016 #73
    Revenge

    Revenge Active Member

    469
    93
    28
    Feb 21, 2016
    Portugal
    Ratings:
    +354
    Local Time:
    8:24 AM
    1.9.x
    10.1.x
    Why won't work behind Cloudflare? If Cloudflare sends the real IP to your server, i don't see why it wouldn't work.
     
  14. May 2, 2016 #74
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    IP Tables does not work with nginx, the real ip is only within web server - so iptables will see cf ip's..
     
  15. May 2, 2016 #75
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    Yes. Same issue! :p

    nginx version: nginx/1.9.15 @ 123.09beta01
     
  16. May 2, 2016 #76
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    And here is a $5.00 USD (DigitalOcean VPS - 1 Core - 512MB Ram). It does not run centmin and can stand online completely fine.

    Reached nearly 10k r/s - same attack on centmin crashes it or something weird happens

    [​IMG]
     
  17. May 2, 2016 #77
    eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    5:24 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
  18. May 2, 2016 #78
    Revenge

    Revenge Active Member

    469
    93
    28
    Feb 21, 2016
    Portugal
    Ratings:
    +354
    Local Time:
    8:24 AM
    1.9.x
    10.1.x
    Fail2ban will get th IP in the Access Log. That log is populated by Nginx with the real ip address ;)
     
  19. May 2, 2016 #79
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
  20. May 2, 2016 #80
    Oxide

    Oxide Active Member

    534
    29
    28
    Mar 19, 2015
    Ratings:
    +59
    Local Time:
    5:24 PM
    Sure, but iptables won't block it ;) It will be cloudflare ip still - means the traffic will still go through cloudflare like a proxy..
     
Previous Thread Next Thread
Loading...
Page 4 of 8

.