Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've recently gotten denial of service attacks from multiple proxy ips, so I installed cloudflare to prevent this. Then I started noticing that they're bypassing cloudflare by connecting directly to the server's ip address and forging the host header.

What is the most performant way to return 403 on connections that aren't from the 18 ip addresses used by cloudflare?
I tried denying all then explicitly allowing the cloudflare ips but this doesn't work since I've set it up so that CF-Connecting-IP sets the ip allow tests for.

I'm using nginx 1.6.0.

share|improve this question
    
What if they DoS you from Cloudflare? –  Vasili Syrakis Jun 3 at 1:42
    
Not sure if I understand your question. When they DoS me from cloudflare they just get locked out by cloudflare's captcha page. Now they're bypassing cloudflare by going straight to my actual IP. –  phillips1012 Jun 3 at 1:49
3  
Might be easier to do it with iptables rules by allowing traffic from the CloudFlare IPs + your own IPs (so you can check if your site is up without going through CloudFlare) and drop everything else sent to port 80. This way the traffic never reaches your web server. –  Brian Jun 3 at 1:49
    
Hmm. The iptables solution seems to work fine. Thanks! I used the longer script here: rietta.com/blog/2012/09/10/using-iptables-to-require-cloudflare for anyone wondering. I'm going to leave this question open in case someone comes up with a nginx-config-file solution so people googling this problem can see it. –  phillips1012 Jun 3 at 3:00

1 Answer 1

The most performant way is a hardware firewall in front of the server. Or asking your datacenter/upstream provider for help mitigating attack.

Block things it in the webserver or iptables may help, but still uses bandwidth and system resources so DoS attacks are still possible. What you want is to block the traffic as far upstream as possible - so the traffic never reaches your server, and doesn't flood your link to the rest of the world. A hardware firewall can filter traffic much, much faster than your webserver, and uses no server resources. You will want them to allow traffic from cloudflare as well as your office or other servers for when you need to connect directly.

Changing the IP of the server may help as well - only cloudflare should need to know the new IP, don't publish it in public DNS records.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.