0

We are getting a Dos attack on our web server. We enabled Cloudflare and add these rules:

If it is not SSL connection Block all. That fixed pretty much all attacks.

I would like to ask pros about this.

When I used that command :

netstat -npt | grep 80 | awk '{print $5}' | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

Output:

 108 5.1xx.1x4.2x5  This is my server IP
 59 1x8.1x4.1x1.1x1
 50 162.1x8.38.196
 40 1x2.x5x.93.1x9
 38 1x2.1x8.226.94
 37 x62.15x.88.248

After seeing my server IP I really confused.

I block all connections to 80 port except cloudflare's.

Right now, Some of my products I use, cannot query licenses from other servers due to blocking 80 ports.

I read some blogs it says SYN attack and my server sending response but not getting any response back so It use a lot of CPU.

How can I solve this problem with Iptables. I think attack is not big one so Iptables can handle If i use right rule.

thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.