Sometimes i have ddos attacks on my server. I'm trying to prevent from this. I'm using Nginx to serve static content and as a reverse proxy and Apache to serve php applications.
When the attack starts, I have a lot of (eg. 3000 IP addresses) that want to reach my page the same time but there is only one IP address per 4 - 5 seconds. But if there is a lot of attackers I still have 400 requests per seconds, but from different IP. So I have problem with blocking it because IP connection rate limit in Nginx doesn't work in this situation. I have about 100 websites on that server. During the attack, Nginx works ok, but the Apache is completely dead, Nginx cannot connect to the upstream for not only the attacked site but for all sites on the server. I have no problem with the situation that during the attack, the attacked site doesn't work, but I want to other sites works without impact.
I need solution that not move attack away, but i want to have working server that can be able to serve other sites when one is being attacked.
Could you help me in some way? I'm thinking about using haproxy in front of Nginx. I would add one backend for each site with concurrent connection limit for about 40 connections. Do you think if it is a good idea? Or maybe you have other ideas how to prevent this kind of attacks?
