首页 > nginx > 转老外一篇NGINX 防DDOS配置

转老外一篇NGINX 防DDOS配置

2011年1月19日 eric 发表评论 阅读评论

FreeBSD, network card: Intel fxp, port: 100Мбит, polling, http accept-filter.
in sysctl:

sysctl kern.maxfiles=90000
           sysctl kern.maxfilesperproc=80000
           sysctl net.inet.tcp.blackhole=2
           sysctl net.inet.udp.blackhole=1
           sysctl kern.polling.burst_max=1000
           sysctl kern.polling.each_burst=50
           sysctl kern.ipc.somaxconn=32768
           sysctl net.inet.tcp.msl=3000
           sysctl net.inet.tcp.maxtcptw=40960
           sysctl net.inet.tcp.nolocaltimewait=1
           sysctl net.inet.ip.portrange.first=1024
           sysctl net.inet.ip.portrange.last=65535
           sysctl net.inet.ip.portrange.randomized=0

in nginx configuration:

  worker_processes 1;
           worker_rlimit_nofile 80000;
           events {
               worker_connections 50000;
           }

           server_tokens off;
           log_format IP `$remote_addr';
           reset_timedout_connection on;

           listen  xx.xx.xx.xx:80  default rcvbuf=8192 sndbuf=16384 backlog=32000 accept_filter=httpready;
 

In the following way it is possible to realize filtration of url, in example for POST
index.php?action=login which is with empty referral.

   set $add 1;
           location /index.php {
                   limit_except GET POST {
                        deny all;
               }
               set $ban "";
               if ($http_referer = "" ) {set $ban $ban$add;}
               if ($request_method = POST ) {set $ban $ban$add;}
               if ($query_string = "action=login" ){set $ban $ban$add;}
               if ($ban = 111 ) {
                   access_log /var/log/[133]nginx/ban IP;
                   return 404;
               }
               proxy_pass http://127.0.0.1:8000; #here is a patch
           }
 

Further we cut it at pf level – loaded into IP table, hosts from which came too many hits.
PF with tables works very quickly. Sources for parsing of logs (ddetect) you can find on http://www.comsys.com.ua/files
Then Cron used once in a minute, to add into ip tables new IPs from a log.
25 Mbyte DDoS, which cuts IPs, the rests fall on nginx which by it is criterion pass IPs and the rests passed on the apache – LA 0, site works.

转载请注明:文章转载自:Eric's linux and nginx! (http://www.nginxs.com)
本文地址:http://www.nginxs.com/linux/433.html

分类: nginx 标签: , ,
  1. 2017年8月24日02:47 | #1

    Greetings! Very useful advice in this particular article!

    It is the little changes that will make the biggest changes.
    Many thanks for sharing!

  2. 2017年8月24日16:47 | #2

    Hey there! I just wanted to ask if you ever have any problems with hackers?
    My last blog (wordpress) was hacked and I ended up losing a few
    months of hard work due to no back up. Do you have any solutions to prevent hackers?

  3. 2017年8月24日21:47 | #3

    Thank you a bunch for sharing this with all of us you really understand what you are
    speaking about! Bookmarked. Please additionally discuss with my website
    =). We can have a hyperlink exchange arrangement between us

  4. 2017年8月25日08:47 | #4

    It’s actually a nice and helpful piece of info.
    I’m satisfied that you simply shared this helpful info with
    us. Please stay us informed like this. Thanks for sharing.

  5. 2017年8月25日15:06 | #5

    We absolutely love your blog and find most of your post’s to be what precisely I’m looking for.
    Do you offer guest writers to write content for yourself?

    I wouldn’t mind creating a post or elaborating on a
    few of the subjects you write with regards to here.

    Again, awesome weblog!

  6. 2017年8月25日15:16 | #6

    What i do not realize is in fact how you’re not really a lot
    more smartly-liked than you may be right now. You’re very
    intelligent. You realize thus significantly in relation to this subject, produced me individually believe it from numerous numerous
    angles. Its like men and women are not fascinated except it’s something
    to accomplish with Woman gaga! Your own stuffs great.
    At all times take care of it up!

  7. 2017年8月25日16:20 | #7

    vásárlás magyarországon, http://www.amarasdance.com/v2/wp-content/gyogyszertar/promethazine.html – természetes rendelés.

  8. 2017年8月25日17:58 | #8

    cena v czechii online, http://newgoldmanagement.com/old/wp-content/lekarna/azithromycine.html – nejlepsi ceny prodej.

  9. 2017年8月25日19:05 | #9
  10. 2017年8月26日03:02 | #10

    exclusive casino bonus
    online casino for us players
    craps game

  11. 2017年8月26日13:38 | #11

    If you wish for to improve your experience only keep visiting this website
    and be updated with the newest news update posted here.

  12. 2017年8月27日19:31 | #12

    Admiring the persistence you put into your blog and detailed information you provide.
    It’s awesome to come across a blog every once in a while
    that isn’t the same unwanted rehashed material. Great read!
    I’ve bookmarked your site and I’m adding your RSS feeds to my Google account.

  13. 2017年8月30日22:38 | #13

    Hmm it seems like your website ate my first comment (it was extremely long) so I guess I’ll just sum it
    up what I wrote and say, I’m thoroughly enjoying your blog.
    I too am an aspiring blog writer but I’m still new to everything.
    Do you have any recommendations for inexperienced blog writers?

    I’d really appreciate it.

  14. 2017年8月31日06:30 | #14

    Wow, that’s what I was seeking for, what a information! present here at this weblog, thanks
    admin of this site.

  15. 2017年8月31日22:47 | #15

    Great beat ! I would like to apprentice while
    you amend your site, how can i subscribe for a weblog website?
    The account aided me a applicable deal. I have been tiny bit familiar of this your broadcast provided vivid transparent idea

  16. 2017年9月1日09:33 | #16

    I like the valuable info you provide in your articles.
    I will bookmark your weblog and check again here regularly.
    I am quite sure I will learn many new stuff right here!
    Good luck for the next!

  17. 2017年9月1日10:20 | #17

    It’s very easy to find out any matter on web as compared to textbooks, as I found
    this post at this web site.

  18. 2017年9月1日23:41 | #18

    Awesome post.

  19. 2017年9月2日01:06 | #19

    Hello! I just wanted to ask if you ever have any issues with hackers?

    My last blog (wordpress) was hacked and I ended up losing
    several weeks of hard work due to no back up. Do you have any methods to protect against hackers?

  20. 2017年9月3日15:33 | #20

    Hurrah! After all I got a webpage from where I be able to
    genuinely obtain valuable information concerning my study and knowledge.

  21. 2017年9月3日22:01 | #21

    What’s up, this weekend is good in support of me, for the reason that this point in time i am reading this great educational article here at my house.

  22. 2017年9月4日01:53 | #22

    can buy viagra vietnam
    viagra without a doctor prescription
    buy viagra portland

  23. 2017年9月4日05:28 | #23

    buy levitra discount
    buy levitra online
    buy levitra germany

  24. 2017年9月4日13:59 | #24

    Amazing blog! Is your theme custom made or did you download it from
    somewhere? A design like yours with a few simple adjustements would really
    make my blog jump out. Please let me know where
    you got your design. Many thanks

  25. 2017年9月5日09:09 | #25

    Have you ever thought about including a little
    bit more than just your articles? I mean, what you say is fundamental and all.
    But think of if you added some great graphics or video
    clips to give your posts more, “pop”! Your content is excellent but with pics and videos, this blog could undeniably be one of the best in its niche.
    Good blog!

  26. 2017年9月5日17:00 | #26

    You have made some really good points there. I looked on the
    net for more information about the issue and found most individuals will go along with your views on this website.

  27. 2017年9月5日17:08 | #27

    Wow, this piece of writing is pleasant, my sister is analyzing these things, therefore I am going to inform her.

  28. 2017年9月7日18:05 | #28

    pa natet recept, http://sverige-apotek.life/dirtop.html , pris pa malmö.

  29. 2017年9月8日05:06 | #29

    [url=http://cialiscostperpill.us.org/]cialis online[/url]

  30. 2017年9月8日10:18 | #30

    Simply want to say your article is as astonishing. The clarity in your put up is simply spectacular and
    that i could assume you’re an expert in this subject.
    Fine along with your permission allow me to snatch your feed to keep updated with
    impending post. Thank you 1,000,000 and please carry on the rewarding work.

  31. 2017年9月8日20:33 | #31
  32. 2017年9月8日20:42 | #32

    Buy generic online uk next day delivery http://hempfieldcob.org/css/pharmacy/xalatan.html#generic_xalatan pill price.

  33. 2017年9月8日21:12 | #33

    alternativ i Sverige, http://sverige-apotek.life/clarityne.html , sälja billiga.

  34. 2017年9月8日23:35 | #34
  35. 2017年9月8日23:56 | #35

    Buy cheap online with prescription http://lightworkscreative.com/digecorp/pharmacy/paroxedura.html#order_paroxedura pill price in malaysia.

  36. 2017年9月10日02:42 | #36

    Hi there just wanted to give you a brief heads
    up and let you know a few of the pictures
    aren’t loading correctly. I’m not sure why but I think its
    a linking issue. I’ve tried it in two different internet
    browsers and both show the same outcome.

  37. 2017年9月10日23:24 | #37

    Pretty! This has been a really wonderful post.
    Thank you for supplying these details.

  38. 2017年9月13日07:51 | #38

    Very good article. I certainly love this website. Thanks!

  39. 2017年9月13日09:17 | #39

    Levitra Generico In Farmacia Online [url=http://cialtobuy.com ]buy cialis[/url] Find cheapeast isotretinoin amex overseas
    Robaxin No Prescription Kamagra Prescription E
    Para Que Sirve El Viagra Yahoo cialis price Prednisone Without A Scrip

  40. 2017年9月13日14:53 | #40

    I loved as much as you will receive carried out right here.

    The sketch is attractive, your authored subject matter stylish.
    nonetheless, you command get bought an impatience
    over that you wish be delivering the following.
    unwell unquestionably come more formerly again as exactly the same nearly a lot often inside case you shield this hike.

  41. 2017年9月13日21:27 | #41

    It’s awesome designed for me to have a web page, which is beneficial
    for my knowledge. thanks admin

  42. 2017年9月14日03:03 | #42

    [url=http://cialiscostperpill.us.org/]cialis[/url]

  43. 2017年9月14日03:24 | #43

    [url=http://cialiscostperpill.us.org/]Cialis[/url]

  44. 2017年9月14日12:26 | #44

    Propecia Aromatase [url=http://cialtobuy.com ]cialis buy online[/url] Propecia Espana Sin Receta
    Brand Cialis Without A Prescription
    Expiration Keflex online pharmacy Acquistare Kamagra A Buon Mercato

  45. 2017年9月15日03:15 | #45
  46. 2017年9月15日03:34 | #46

    Buy safely online uk http://www.students4houses.co.uk/wp-content/pharmacy/correctol.html can you buy online uk.

  47. 2017年9月15日03:49 | #47
  48. 2017年9月15日05:01 | #48

    [url=http://buypaxil.shop/]paxil[/url] [url=http://wellbutrin.shop/]wellbutrin[/url]

  49. 2017年9月15日05:17 | #49

    [url=http://bupropionsr150mg.us.org/]bupropion sr 150 mg[/url] [url=http://effexorxr.us.org/]Buy Effexor[/url]

  50. 2017年9月15日05:46 | #50

    [url=http://erythromycin500mg.us.org/]erythromycin 500 mg[/url] [url=http://fluoxetine247.us.com/]order fluoxetine[/url]

评论分页
订阅评论
1+5= (必填)