Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with, my external databes server IP and about 100 search engine scrapers.

This system was working well for a while until for a yet unknown reason DDos deflate decided to ban out of the blue. This prevented a php-fpm of things from running. I switched FPM to unix socket instead, so if localhost was banned again, it would run fine.

But today out of the blue DDOS deflate banned my external database server. This IP was always whitelisted, and this IP always has well over the set limit of connections, so the whitelisting worked. But today out of the blue, boom also this IP got banned, and was removed from the whitelist.

I am totally freaked out, and have stopped using DDOS deflate for now. What could be causing this? DDOS deflate was successfully banning/unbanning new IP's all the time, and it would honor the whitelist. But once in a while, it just randomly removes items from that whitelist, and bans them.

Maybe someone also knows a good alternative to DDOS deflate? I work with IPTABLES.

closed as off-topic by Tom O'Connor Aug 25 '13 at 21:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Tom O'Connor
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Do you need DDoS Deflate? If not, why are you running it? – voretaq7 Jan 13 '12 at 3:08
  • Yes, my webserver is often under attack by people, and I want to block heavy scrapers. DDOS deflate does a great job banning people who flood the site. As long as it doesn't ban IP's I have whitelisted.. :'( – Mr.Boon Jan 13 '12 at 3:13
  • When you say it "removes items from that whitelist", do you mean the actual whitelist file is modified? – David Schwartz Jan 13 '12 at 3:18
  • Yes, when I manually open /usr/local/ddos/ignore.ip.list the first 2 ip's should be and the 2nd one my DB server's ip. These have both been automatically removed at some point. I have checked all login history/bash history. Nobody else has been on my machine. DDOS deflate uses the whitelist to also ban people. The way this system works is that Banned IP's also get written to the whitelist during the ban. inetbase.com/scripts/ddos/ddos.sh that is the main script. – Mr.Boon Jan 13 '12 at 3:27
  • Then it sounds like the script is broken. Perhaps it doesn't use proper file locks to prevent concurrent updates from breaking the list. – David Schwartz Jan 13 '12 at 8:17

I started using https://github.com/ess/citadel which works very well so far.

Not the answer you're looking for? Browse other questions tagged or ask your own question.