Alright, so my friend and I are setting up a new website. We expect heavy DDoS attacks, so our plan is to use nginx to proxy from various cloud servers so that people can't find our actual server's IP.

However, we need to link all these proxy servers up to one domain, so that when the domain (we'll say domain.com) is requested, it chooses a proxy server to send the user to and sticks them there. It also, however, needs to check if the server it's sending the user to is actually up and running (and has internet connectivity). If the server it's sending the user to is under attack, it kind of defeats the purpose of the proxy servers in the first place.

Any idea on how to do this?

  • 5
    ... what kind of website are you setting up that you EXPECT a DDoS? :-) – voretaq7 Jul 22 '11 at 20:42
  • 1
    @voretaq7: One that provides better products than our competitors – Rob Jul 22 '11 at 22:47
  • 4
    Must be an interesting product or niche...I don't know if "DDoS our competitors" is a standard practice in professional businesses. – Bart Silverstrim Jul 23 '11 at 12:06
  • 2
    Actually, when it's uncovered that a business is actively denial-of-servicing other companies, it's normally considered very unprofessional and a sign that your product isn't good enough to actually compete in the marketplace on it's own merit. Not to mention that it makes your company look seedy and untrustworthy, and if you're actively engaging in DDoS attacks on other companies, I don't see much incentive for other here on SF to help further your endeavors. – Bart Silverstrim Jul 24 '11 at 23:11
  • 1
    Even if Bart didn't explain his point a view to a way even you can understand, he's right! There is no reason that you might suffer even a trial DDoS, expect if you are some black hat arse. – Anarko_Bizounours Jul 25 '11 at 7:25

I'm not sure why you want to round robin DNS here,it's completely useless here. The proper setup would be to set your A record to your load balancer. Then set a heartbeat to the Webserver to check if it is online. The idea behind helping during an attack is by spreading the load across several servers and to scale up to compensate and scale down after the attack.

  • 2
    +1 - if you're really concerned you want to do the same kind of BGP-level load balancing that is used on the root servers (announce the address from multiple ISPs, let the network sort out which path to send your users through). A less hideously expensive solution is to run your site on something like Amazon's EC2 with their load-balancing... – voretaq7 Jul 22 '11 at 20:44
  • 1
    @voretaq7: What you describe is "anycast", and it's horrendously unreliable for TCP connections. – womble Jul 25 '11 at 5:24
  • @Womble - anycast for TCP is definitely not an ideal solution (as you implied, natural route changes can make it blow up). GeoIP-assisted DNS is probably a better real-world solution (less black magic required / chance of things breaking if the internet decides on a different routing for your packets, and still provides reasonable isolation: If one location gets knocked out the rest keep functioning, and a DDoS by hostname may be distributed to a point where it doesn't take the site down anyway) – voretaq7 Jul 25 '11 at 15:05

The only problem I see here is that round robin returns A records in sequential order, not checking if the IP address it's returning is actually online or not.

  • Yes, thank you for that. I'm quite aware of that and hence why I'm asking how to do what I asked, rather than just a simple round robin. – Rob Jul 22 '11 at 20:16
  • 2
    You might want to take "round robin DNS" out of the question title if you're not planning on using it. – womble Jul 25 '11 at 5:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.