I am trying to setup HaProxy with DDoS protection rules (rate limiting). However, I think HaProxy is now rate limiting CloudFlare IPs instead of Visitor/Real IPs. (note: my site itself is fine, because I have fixed that in the PHP code of my site) How can I fix that?
My /etc/haproxy/haproxy.cfg
global
log 127.0.0.1 local0 notice
maxconn 10000
user haproxy
group haproxy
defaults
log global
mode http
option httplog
option dontlognull
retries 3
option redispatch
timeout http-request 10s
timeout connect 5000
timeout client 30s
timesout server 5000
frontend domain
bind *:80
stick-table type ip size 1m expire 10s store gpc0,http_req_rate(10s)
tcp-request connection track-sc1 src
tcp-request connection reject if { src_get_gpc0 gt 0 }
default_backend nginx
backend nginx
mode http
stats enable
stats uri /HIDDEN
stats realm Strictly\ Private
stats auth USER:PASSWORD
balance roundrobin
option httpclose
option httpchk HEAD / HTTP/1.1\r\nHost:domainhidden.eu
acl abuse src_http_req_rate(domain) ge 100
acl flag_abuser src_inc_gpc0(domain)
tcp-request content reject if abuse flag_abuser
server web1 iphere1:80 check
server web2 iphere2:80 check
server web3 iphere3:80 check
I have changed the domain, user and password in the config, because otherwise people could get into my website stats :P (domainhidden.eu, USER:PASSWORD and 'iphere')