首页 > nginx > 转老外一篇NGINX 防DDOS配置

转老外一篇NGINX 防DDOS配置

2011年1月19日 eric 发表评论 阅读评论

FreeBSD, network card: Intel fxp, port: 100Мбит, polling, http accept-filter.
in sysctl:

sysctl kern.maxfiles=90000
           sysctl kern.maxfilesperproc=80000
           sysctl net.inet.tcp.blackhole=2
           sysctl net.inet.udp.blackhole=1
           sysctl kern.polling.burst_max=1000
           sysctl kern.polling.each_burst=50
           sysctl kern.ipc.somaxconn=32768
           sysctl net.inet.tcp.msl=3000
           sysctl net.inet.tcp.maxtcptw=40960
           sysctl net.inet.tcp.nolocaltimewait=1
           sysctl net.inet.ip.portrange.first=1024
           sysctl net.inet.ip.portrange.last=65535
           sysctl net.inet.ip.portrange.randomized=0

in nginx configuration:

  worker_processes 1;
           worker_rlimit_nofile 80000;
           events {
               worker_connections 50000;
           }

           server_tokens off;
           log_format IP `$remote_addr';
           reset_timedout_connection on;

           listen  xx.xx.xx.xx:80  default rcvbuf=8192 sndbuf=16384 backlog=32000 accept_filter=httpready;
 

In the following way it is possible to realize filtration of url, in example for POST
index.php?action=login which is with empty referral.

   set $add 1;
           location /index.php {
                   limit_except GET POST {
                        deny all;
               }
               set $ban "";
               if ($http_referer = "" ) {set $ban $ban$add;}
               if ($request_method = POST ) {set $ban $ban$add;}
               if ($query_string = "action=login" ){set $ban $ban$add;}
               if ($ban = 111 ) {
                   access_log /var/log/[133]nginx/ban IP;
                   return 404;
               }
               proxy_pass http://127.0.0.1:8000; #here is a patch
           }
 

Further we cut it at pf level – loaded into IP table, hosts from which came too many hits.
PF with tables works very quickly. Sources for parsing of logs (ddetect) you can find on http://www.comsys.com.ua/files
Then Cron used once in a minute, to add into ip tables new IPs from a log.
25 Mbyte DDoS, which cuts IPs, the rests fall on nginx which by it is criterion pass IPs and the rests passed on the apache – LA 0, site works.

转载请注明:文章转载自:Eric's linux and nginx! (http://www.nginxs.com)
本文地址:http://www.nginxs.com/linux/433.html

分类: nginx 标签: , ,
  1. mark35
    2011年10月26日16:09 | #1

    sysctl net.inet.ip.portrange.first=1024
    ========================
    从1024开始占用,也忒狠了点吧。监听3306,5432,10024这些端口的程序表示有压力

  2. 2018年4月3日23:24 | #2
  3. 2018年4月4日01:20 | #3

    oayevq visit website

  4. 2018年4月4日03:13 | #4
  5. 2018年4月4日05:01 | #5

    rpxtof sildenafil

  6. 2018年4月4日06:48 | #6
  7. 2018年4月4日15:57 | #7

    professional essay writing services college paper writing service sort

  8. 2018年4月5日03:16 | #8
  9. 2018年4月5日05:34 | #9

    levitra cost levitra not

  10. 2018年4月5日09:32 | #10

    buy levitra levitra cost perfectly

  11. 2018年4月5日20:07 | #11

    online casino
    casinos online
    play casino games online
    casino online application

  12. 2018年4月5日21:14 | #12

    casino online free
    free casino games and poker
    online casino
    casino g

  13. 2018年4月5日23:22 | #13

    casino online
    new usa online casinos 2017
    casino online usa
    casino online usa

  14. 2018年4月6日00:04 | #14

    vegas casino games
    pogo casino slots
    casino games free online
    pogo casino slots

  15. 2018年4月6日01:16 | #15

    casino online usa
    casino online gambling
    casino online for fun
    pogo casino slots

  16. 2018年4月6日04:20 | #16

    new usa online casinos
    casino online
    casino g
    best online casino games free

  17. 2018年4月6日05:36 | #17

    o essay writing service happiness

  18. 2018年4月6日08:22 | #18
  19. 2018年4月6日10:58 | #19
  20. 2018年4月6日18:15 | #20

    d write my essay broken

  21. 2018年4月7日00:23 | #21
  22. 2018年4月7日12:47 | #22
  23. 2018年4月14日00:20 | #23

    cheap clomid buy clomid online single

  24. 2018年4月14日04:44 | #24

    can i order prescription drugs from canada can i order prescription drugs from canada getting

  25. 2018年4月14日18:31 | #25

    order clomid clomid rather

  26. 2018年4月14日20:48 | #26

    levitra coupons buy levitra online save

  27. 2018年4月15日04:15 | #27

    buy propecia propecia online minutes

  28. 2018年4月15日10:37 | #28

    buy medication without an rx cheap buy rx online no prior prescription unless

  29. 2018年4月15日22:32 | #29

    clomid pills buy clomid too

  30. 2018年4月16日07:08 | #30

    how to order prescription drugs from canada buy medication without an rx cheap true

  31. 2018年4月16日08:13 | #31

    cheap clomid clomid same

  32. 2018年4月17日07:06 | #32

    propecia online propecia coupons glass

  33. 2018年4月17日09:02 | #33

    propecia coupons generic propecia gentleman

  34. 2018年4月19日22:18 | #34

    Treating carpet molds on your own might be very dangerous.

  35. 2018年4月20日00:27 | #35

    The Silverback 20 mil liner was the proper fit.

  36. 2018年4月20日16:40 | #36

    These are all symptoms of basis points needing
    repair.

  37. 2018年4月21日18:24 | #37

    Mould spores won’t survive in dry climates.

  38. 2018年4月22日01:16 | #38

    Fasteners tear the paper on floor sanders.

  39. 2018年4月23日13:53 | #39

    Glorioso Tree Service is a UNBELIEVABLE company.

订阅评论
4+3= (必填)