This question already has an answer here:
- I am under DDoS. What can I do? 3 answers
I have a site that was being hit with a DDOS the same time every day for the past month, and after spending a month researching and pinpointing the bug, we enacted a bash script which if the connection is reaching 80+ max connections in one minute then the IP is banned and put into IPTABLES.
This worked great for two days and I felt like I finally solved the problem.
But alas, now the person is sending multiple IPs with just one connection on each (review the output here http://pastebin.com/7AJqBfJa). This is bringing the site down just as it was when one IP was sending 150 connections per minute.
This of course is an entirely different ballgame when it comes to preventing a DDOS, and I am seeking help from the gurus and anyone nice enough to care, to give some advice. At this point I'm at a loss on how to fix this, and any help would be greatly appreciated.