首页 > nginx > 转老外一篇NGINX 防DDOS配置

转老外一篇NGINX 防DDOS配置

2011年1月19日 eric 发表评论 阅读评论

FreeBSD, network card: Intel fxp, port: 100Мбит, polling, http accept-filter.
in sysctl:

sysctl kern.maxfiles=90000
           sysctl kern.maxfilesperproc=80000
           sysctl net.inet.tcp.blackhole=2
           sysctl net.inet.udp.blackhole=1
           sysctl kern.polling.burst_max=1000
           sysctl kern.polling.each_burst=50
           sysctl kern.ipc.somaxconn=32768
           sysctl net.inet.tcp.msl=3000
           sysctl net.inet.tcp.maxtcptw=40960
           sysctl net.inet.tcp.nolocaltimewait=1
           sysctl net.inet.ip.portrange.first=1024
           sysctl net.inet.ip.portrange.last=65535
           sysctl net.inet.ip.portrange.randomized=0

in nginx configuration:

  worker_processes 1;
           worker_rlimit_nofile 80000;
           events {
               worker_connections 50000;
           }

           server_tokens off;
           log_format IP `$remote_addr';
           reset_timedout_connection on;

           listen  xx.xx.xx.xx:80  default rcvbuf=8192 sndbuf=16384 backlog=32000 accept_filter=httpready;
 

In the following way it is possible to realize filtration of url, in example for POST
index.php?action=login which is with empty referral.

   set $add 1;
           location /index.php {
                   limit_except GET POST {
                        deny all;
               }
               set $ban "";
               if ($http_referer = "" ) {set $ban $ban$add;}
               if ($request_method = POST ) {set $ban $ban$add;}
               if ($query_string = "action=login" ){set $ban $ban$add;}
               if ($ban = 111 ) {
                   access_log /var/log/[133]nginx/ban IP;
                   return 404;
               }
               proxy_pass http://127.0.0.1:8000; #here is a patch
           }
 

Further we cut it at pf level – loaded into IP table, hosts from which came too many hits.
PF with tables works very quickly. Sources for parsing of logs (ddetect) you can find on http://www.comsys.com.ua/files
Then Cron used once in a minute, to add into ip tables new IPs from a log.
25 Mbyte DDoS, which cuts IPs, the rests fall on nginx which by it is criterion pass IPs and the rests passed on the apache – LA 0, site works.

转载请注明:文章转载自:Eric's linux and nginx! (http://www.nginxs.com)
本文地址:http://www.nginxs.com/linux/433.html

分类: nginx 标签: , ,
  1. 2018年7月16日11:23 | #1

    wow cialis rx

    [url=http://cialischeapoiw.com/]cheap cialis[/url]
    generic cialis online

    online us cialis

  2. 2018年7月18日03:45 | #2

    Скажите мне, пожалуйста – где я могу найти больше информации по этому вопросу?


    Интересно, а аналог есть? интересные товары, теории интересные а также [url=http://dominant.zp.ua/blog/innokentiy]тут[/url] комиксы интересные
    [url=http://ra2.in/forum/meropriyatiya/topic-475.html]тут[/url]
    [url=http://routes.in.ua/tema/%d0%b7%d0%b0%d0%b9%d0%bc%d1%8b-%d0%be%d0%bd%d0%bb%d0%b0%d0%b9%d0%bd-2/]тут[/url]
    [url=http://partemp.com/en/forums/topic/%d0%b7%d0%b0%d0%b9%d0%bc%d1%8b-%d0%be%d0%bd%d0%bb%d0%b0%d0%b9%d0%bd-2/]тут[/url]
    [url=http://www.iconestates.net/index.php?option=com_k2&view=itemlist&task=user&id=72217]тут[/url]
    [url=http://pchelovodstvo.su/forum/?PAGE_NAME=message&FID=11&TID=90&MID=97&result=new#message97]тут[/url]
    [url=http://forum.horizonsweightloss.com/groups/%d0%b7%d0%b0%d0%b9%d0%bc%d1%8b-%d0%be%d0%bd%d0%bb%d0%b0%d0%b9%d0%bd-152234095/]тут[/url]
    [url=http://mail.vzletim.aero/forum/messages/forum13/topic3883/message6726/?result=new#message6726]тут[/url]
    [url=http://sedalink.ru/forum/?PAGE_NAME=message&FID=1&TID=1953&MID=20689&result=new#message20689]тут[/url]
    [url=http://bezone.ru/node/18821]тут[/url]
    [url=http://cssbym.ru/forum/showtopic-2901]тут[/url]

  3. 2018年7月19日03:28 | #3

    cialis 20 forum

    [url=http://cialisbuyap.com/]cialis cheap[/url]
    generic cialis

    pastilla cialis us

  4. 2018年7月19日17:47 | #4

    vegas casino games
    online casino real money
    top rated free online casino games
    new usa online casinos

评论分页
1 ... 5 6 7 433
订阅评论
5+7= (必填)