A Django based web forum I maintain has recently been subjected to frequent DDOS attacks at the application layer. Essentially, it seems to be an HTTP flood hitting the home page, causing the server to execute a large number of internal requests and load various files to create the page. The flood peaks at ~4000 requests per minute (typical throughput being around 500 rpm), bringing down my server in the process.
My webserver is nginx serving as reverse proxy for a gunicorn application server.
I haven't yet utilized gunicorn's security parameters:
limit_request_field_size). But I have nginx fail2ban installed, and have two jails in my
jail.local to ensure HTTP floods are thwarted:
[nginx-postflood] enabled = true filter = nginx-postflood port = http,https logpath = /var/log/nginx/access.log findtime = 60 maxretry = 13 bantime = 300 [nginx-getflood] enabled = true filter = nginx-getflood port = http,https logpath = /var/log/nginx/access.log findtime = 5 maxretry = 6 bantime = 600
This setting has not helped, and I can't figure out why. When I test it, I'm able to block my IP, so it's definitely functional. Perhaps the HTTP flood has randomized IPs.
What tactics can I employ to thwart this kind of application layer DDOS? Being a newbie, I'm still wrapping my head around all this. Expert help is much appreciated!