Anti DDOS not working for proxy server

F

freeballt

Active Member
#1
#1
I'm using cloudflare with my litespeed installation and have been getting hit with a DDOS lately. I have the server setup so that it only allows 7 dynamic requests from a user per second. My logs show a number of ips requesting the same file several times a second (over 10). I suspect since I'm using cloudflare and have those IP's whitelisted, that the DDOS ips aren't being blocked.

In addition, is there a way to block IPs without going through the interface, such as using a ssh command?
 
D

damoncloudflare

New Member
#3
#3
DDoS

freeballt said:
I'm using cloudflare with my litespeed installation and have been getting hit with a DDOS lately. I have the server setup so that it only allows 7 dynamic requests from a user per second. My logs show a number of ips requesting the same file several times a second (over 10). I suspect since I'm using cloudflare and have those IP's whitelisted, that the DDOS ips aren't being blocked.

In addition, is there a way to block IPs without going through the interface, such as using a ssh command?
Click to expand...
Just a quick note that you might want to consider using CloudFlare's DDoS mitigation feature as an option as well (don't know how the large the attack is you're trying to manage).
 
F

freeballt

Active Member
#4
#4
damoncloudflare said:
Just a quick note that you might want to consider using CloudFlare's DDoS mitigation feature as an option as well (don't know how the large the attack is you're trying to manage).
Click to expand...
The 5s wait thing is annoying to my users. Ive had complaints about it.

I limited dynamic requests to 1 a second, and there are NO ips in the temporary ban list. There is obviously a problem with using cloudflare or some other proxy service and ip banning with litespeed.
 
Last edited:
F

freeballt

Active Member
#6
#6
It's an issue with the message and having to wait 5 seconds. Obviously I don't know what you guys are doing behind the scenes during those 5 seconds, but it makes no sense why you guys would display that message or any prompt (seems unnecessary, or rather advertising).

Having said that, I think if you guys offered a service where we could skin our own captcha page that is well worth a premium subscription.
 
D

damoncloudflare

New Member
#7
#7
Hi,

"Having said that, I think if you guys offered a service where we could skin our own captcha page that is well worth a premium subscription."

Being worked on (don't know the account level type that will be offered with yet).

"It's an issue with the message and having to wait 5 seconds. Obviously I don't know what you guys are doing behind the scenes during those 5 seconds, but it makes no sense why you guys would display that message or any prompt (seems unnecessary, or rather advertising)."

Don't think there is an easy solution for the 5 seconds (will mention it). Basically, we're running some checks on the visitor to see if they exhibit behaviors of a botnet or other type of attack (generally have some specific signatures during a DDoS). I'm sure we'll figure out a way to speed it up.
 
F

freeballt

Active Member
#8
#8
damoncloudflare said:
"Having said that, I think if you guys offered a service where we could skin our own captcha page that is well worth a premium subscription."

Being worked on (don't know the account level type that will be offered with yet).

"It's an issue with the message and having to wait 5 seconds. Obviously I don't know what you guys are doing behind the scenes during those 5 seconds, but it makes no sense why you guys would display that message or any prompt (seems unnecessary, or rather advertising)."

Don't think there is an easy solution for the 5 seconds (will mention it). Basically, we're running some checks on the visitor to see if they exhibit behaviors of a botnet or other type of attack (generally have some specific signatures during a DDoS). I'm sure we'll figure out a way to speed it up.
Click to expand...
Perhaps when DDOS mitigation is enabled, all connections are logged and you have something in the background does log parsing. That way the frontend isn't affected and it isn't as intensive or annoying. It's more than likely going to be a repeated attack, so getting them on the first time through isn't really essential, blocking them later down the road is the goal.

I find logs to be helpful during HTTP attacks because you can find out who is attacking what and block the offending ips.
 
W

webizen

Well-Known Member
#9
#9
freeballt said:
Perhaps when DDOS mitigation is enabled, all connections are logged and you have something in the background does log parsing. That way the frontend isn't affected and it isn't as intensive or annoying. It's more than likely going to be a repeated attack, so getting them on the first time through isn't really essential, blocking them later down the road is the goal.

I find logs to be helpful during HTTP attacks because you can find out who is attacking what and block the offending ips.
Click to expand...
Consider Litespeed Advanced Anti-DDoS Setup (https://store.litespeedtech.com/store/cart.php?gid=5)
 
D

damoncloudflare

New Member
#10
#10
Hi,

"I find logs to be helpful during HTTP attacks because you can find out who is attacking what and block the offending ips.[/QUOTE]

We should still pass along the IPs to your server (at least if you have the mod for LiteSpeed done).

One other option, at least if you don't like the "I'm Under Attack" mode, is to temporarily turn your security settings to "High" for Basic Security Level & this will challenge more visitors with a captcha.

Are there areas you don't want traffic from? You could also look at blocking rules on your server from countries you don't want to access your site.
 
You must log in or register to reply here.
Top