Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

In last days my apache is being attacked by many connections from proxies. I've identified the source but could not block the attack effectively.

The attacker seems to be using pyloris or a variation of this to attack my apache on port 80.

I installed nginx and varnish but not enough to support the extra load.

I also added a rule in iptables to drop packets that contain the string "X-Forwarded-For" but does not block all the proxies.

Does anyone have a suggestion?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 17:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 1 down vote accepted

Usually pyloris attacks are utilised using TOR network. As first step I would suggest you to block ip addresses of TOR network and check if it helps at all.

Here is a list of TOR network's ip addresses

Let us know if it helps

share|improve this answer
Additionally, setting low timeouts in nginx and connlimits via iptables can help. – tristan Jan 16 '13 at 11:32
@tristan I set the nginx timeout to 3s and connlimit to 30/s but the problem is that the requests come from many different ips and all are proxies. – Digorp Jan 16 '13 at 12:17
@Hex It does not help much because most proxies are not those who are on this list. – Digorp Jan 16 '13 at 12:18
@Digorp what are some of the example 'proxies' that you're seeing? What scale of connections are you receiving? – tristan Jan 16 '13 at 12:24
@Digorp : Can you try the iptables rule I added to my answer? – Hex Jan 16 '13 at 12:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.