This question already has an answer here:
- I am under DDoS. What can I do? 3 answers
I've been playing around with the Varnish cache server and I got my webpage up lightning fast, it gets 97 Points in Google's Pagespeed and 100 @ Pingdom's. I used Varnish (proxies to nginx), NGINX (only locally available, proxies *.php to php-fpm (but I think about moving to HipHop PHP Compiler)).
So as my page was fast and only ~500/1GB of Ram were used I asked a friend of mine to perform a stress test on this machine's HTTP server. I've configured the following Anti-DDoS-mechanisms:
- iptables Firewall limiting Connections / second
- some more iptables checks (Sessions starting with a SYN, ICMP and so on)
- Varnish caching
- Re-coded the small webpage to store some values that may be fetched often in the alternate php cache (i.e.: the currently playing song, ttl of 120 should be fine)
There is no dynamic data on the webpage except for the currently playing song which is APC-powered, and definetly no need for sessions.
So now to my problem, my friend started a DoS attack from some machine he was authorized to use and my server went down VERY fast. I was umable to get on SSH so I used a serial console and checked the varnishd logs, which showed: session start session end
And this repeating all the time. I took advance of my console access and banned the IPs, ê voila my page was back.
Now since there is no need for session I need the VCL Syntax for prohibiting all sessions except for scripts in the subdir /user.