Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have many requests with refferer like and etc. to main and couple another pages of site. Line from access.log - - [11/Jan/2013:02:30:30 +0400] "GET /topic?criteria=%&x=0&y=0&pageNo=34 HTTP/1.1" 403 571 "" "Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.1)"

I use iptables to block ips by hand but I found script (D)DoS Deflate and added it to cron but It's gave any results. After that I add to nginx config next

if ($http_referer ~* "ask\.com") {
    return 403;

It's working and I can open site now. But I think it isn't good idea. Please advise some methods to protect from DDOS attack.

share|improve this question

closed as not constructive by Sirex, Sven, faker, mdpc, Khaled Jan 11 '13 at 2:15

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

What DDoS attack? – Michael Hampton Jan 10 '13 at 23:18

Using iptables to block a DoS attack is not a valid solution. Your firewall has to drop the packets, so doesn't that mean the traffic is going to do the damage either way? Bandwidth consumption is the real issue here.

I would suggest contacting your ISP so they can stop the attack on the backbone.

note I would consider other reasons for your site being unresponsive. With what you've provided, I don't see a reason to think that it's a large amount of traffic causing problems.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.