Skip to content
Sudonix

how to prevent DDoS attacks ?

Solved Vulnerability
34 2 13.5k 1
  • crazycells crazycells

    @phenomlab they have firewall but we have to input individual rules, there is no country block.

    Additionally, we use UFW and we only allow https.

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #6

    @crazycells have you seen this?

    https://www.ustoopia.nl/technical/tips-and-tricks/block-countries-based-on-geo-data-with-ufw-firewall/

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells have you seen this?

    https://www.ustoopia.nl/technical/tips-and-tricks/block-countries-based-on-geo-data-with-ufw-firewall/

    crazycells
    crazycells
    crazycells
    wrote on
    #7

    @phenomlab yes, we were checking here yesterday, but we have seen comments about disabled ufw after doing this… so, we have skipped it…

    additionally, we see 4-5 countries on the list… and I think the attackers are stubborn people, so the list might become longer after these settings.

    0
  • crazycells crazycells

    @phenomlab they have firewall but we have to input individual rules, there is no country block.

    Additionally, we use UFW and we only allow https.

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #8

    @crazycells In addition, if you are using Virtualmin, you can leverage Fail2Ban which is a lot more powerful.

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    0
  • phenomlab phenomlab

    @crazycells In addition, if you are using Virtualmin, you can leverage Fail2Ban which is a lot more powerful.

    crazycells
    crazycells
    crazycells
    wrote on
    #9

    @phenomlab yes, we do have fail2ban set up already, sorry I wrote in the first post, but I did not write the usual way 😄 Fail2Ban

    😊
    0
  • crazycells crazycells

    @phenomlab yes, we do have fail2ban set up already, sorry I wrote in the first post, but I did not write the usual way 😄 Fail2Ban

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #10

    @crazycells There is also a way to do this with fail2ban using

    https://blog.reinhard.codes/2023/04/02/restricting-access-to-ssh-using-fail2ban-and-geoip/

    Obviously, you substitute port 22 (SSH) for port 443 (HTTPS)

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells There is also a way to do this with fail2ban using

    https://blog.reinhard.codes/2023/04/02/restricting-access-to-ssh-using-fail2ban-and-geoip/

    Obviously, you substitute port 22 (SSH) for port 443 (HTTPS)

    crazycells
    crazycells
    crazycells
    wrote on
    #11

    @phenomlab can I ask your values of these settings?

    Screen%20Shot%202023-11-15%20at%2018.38.00.jpeg

    0
  • crazycells crazycells

    @phenomlab can I ask your values of these settings?

    Screen%20Shot%202023-11-15%20at%2018.38.00.jpeg

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #12

    @crazycells I’d leave those as they are and handle this much further upstream (at NGINX or OS level)

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells I’d leave those as they are and handle this much further upstream (at NGINX or OS level)

    crazycells
    crazycells
    crazycells
    wrote on
    #13

    @phenomlab we already have those settings changed before, so it might help if I know the default values… 😊 I guess you have them unchanged? Can I learn those default values?

    0
  • crazycells crazycells

    @phenomlab we already have those settings changed before, so it might help if I know the default values… 😊 I guess you have them unchanged? Can I learn those default values?

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #14

    @crazycells Of course - see below

    81935872-9237-4794-8f01-b5c0a32c7c3b-image.png

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • crazycells
    crazycells
    crazycells
    wrote on
    #15

    maybe we should switch to aws, it has a shield for ddos protection…

    https://aws.amazon.com/shield/ddos-attack-protection/

    which provider do you think is best against ddos attacks?

    0
  • crazycells crazycells

    maybe we should switch to aws, it has a shield for ddos protection…

    https://aws.amazon.com/shield/ddos-attack-protection/

    which provider do you think is best against ddos attacks?

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #16

    @crazycells Hetzner also has excellent DDoS protection, a stateful firewall, and I have a referral link meaning you get credits for free… 🙂

    EDIT: Much of this really depends on where you want your server placed. Hetzner are based in Germany, Helsinki, and now the US 🙂

    https://www.hetzner.com/cloud

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    crazycells 2 Replies
    1
  • phenomlab phenomlab

    @crazycells Hetzner also has excellent DDoS protection, a stateful firewall, and I have a referral link meaning you get credits for free… 🙂

    EDIT: Much of this really depends on where you want your server placed. Hetzner are based in Germany, Helsinki, and now the US 🙂

    https://www.hetzner.com/cloud

    crazycells
    crazycells
    crazycells
    wrote on
    #17

    @phenomlab sure, please send me your link. we were considering aws quite some time, but I will send your link to our developer as well, so he can make decision.

    in general, we were trying to stay away from europe or european products due to strict laws and requirements. our user base is either from the US or from Turkey, so we prefer to decrease the amount of work we do 😄

    phenomlab 1 Reply
    0
  • phenomlab phenomlab

    @crazycells Hetzner also has excellent DDoS protection, a stateful firewall, and I have a referral link meaning you get credits for free… 🙂

    EDIT: Much of this really depends on where you want your server placed. Hetzner are based in Germany, Helsinki, and now the US 🙂

    https://www.hetzner.com/cloud

    crazycells
    crazycells
    crazycells
    wrote on
    #18

    @phenomlab oh I see a link there now, but I believe that is not referral link?

    0
  • crazycells crazycells

    @phenomlab sure, please send me your link. we were considering aws quite some time, but I will send your link to our developer as well, so he can make decision.

    in general, we were trying to stay away from europe or european products due to strict laws and requirements. our user base is either from the US or from Turkey, so we prefer to decrease the amount of work we do 😄

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #19

    @crazycells You’d be better placed with Hetzner in the US I think. AWS can get VERY expensive very quickly. My referral link for Hetzner is below.

    I personally use Hetzner and also have a “storage box” with 1Tb of storage for backups located in another datacentre for recovery purposes.

    https://hetzner.cloud/?ref=b2bBQLHF3mEV

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab
    phenomlab
    phenomlab
    wrote on
    #20

    This might also be useful…

    image.png

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    This might also be useful…

    image.png

    crazycells
    crazycells
    crazycells
    wrote on
    #21

    @phenomlab on a side note, is there any easy way to implement a rule… to allow only two geolocation (countries) but block the access from the rest of the countries?

    0
  • crazycells crazycells

    @phenomlab on a side note, is there any easy way to implement a rule… to allow only two geolocation (countries) but block the access from the rest of the countries?

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #22

    @crazycells yes, but without Cloudflare you’d need to perform more checks to determine traffic origin before you have make a decision as to block or permit.

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells yes, but without Cloudflare you’d need to perform more checks to determine traffic origin before you have make a decision as to block or permit.

    crazycells
    crazycells
    crazycells
    wrote on
    #23

    @phenomlab yes, we are planning to install Cloudflare again…

    We will go with “Pro” version and see how it works, I guess this should help not to have any session errors… Previously, we got many connection problems because of Cloudflare…

    0
  • crazycells crazycells

    @phenomlab yes, we are planning to install Cloudflare again…

    We will go with “Pro” version and see how it works, I guess this should help not to have any session errors… Previously, we got many connection problems because of Cloudflare…

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #24

    @crazycells I wouldn’t be so sure. The pro version of Cloudflare is $20 per month but I don’t think that will resolve the connectivity issues.

    There also the harm that CF causes to SEO if you use their bot fight mode as I mention here

    https://sudonix.org/topic/503/cloudflare-bot-fight-mode-and-google-search

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells I wouldn’t be so sure. The pro version of Cloudflare is $20 per month but I don’t think that will resolve the connectivity issues.

    There also the harm that CF causes to SEO if you use their bot fight mode as I mention here

    https://sudonix.org/topic/503/cloudflare-bot-fight-mode-and-google-search

    crazycells
    crazycells
    crazycells
    wrote on
    #25

    @phenomlab I have a good news. We set up CloudFlare Pro, and did not have connection problems yet.

    As you said, it costs $20/month if you subscribe annually, but we did monthly ($25) since we were not sure if this will work for us. So far everything looks OK. We will also check “Google Search” problem you mentioned as well after we secure our forum. Thanks a lot for this warning!

    Unfortunately, we had no choice about Cloudflare since we were getting more than 1 billion connection request from bots and forum was unusable for several hours two consecutive days…

    Screen Shot 2023-11-15 at 16.49.45.png

    Screen Shot 2023-11-18 at 13.22.28.png

    Screen Shot 2023-11-18 at 13.24.55.png

    crazycells phenomlab 2 Replies
    1
Log in to reply

Did this solution help you?
Did you find the suggested solution useful? Support 💗 Sudonix with a coffee ☕
If your organisation needs deeper expertise around infrastructure, security, or technology leadership, learn more about Phenomlab Ltd. Many of the deeper technical guides behind Sudonix are published there.

Related Topics
  • DownPW

    Glitch effect when refreshing the home page

    Customisation javascript nodebb customisation glitch effect
    17
    14 Votes
    17 Posts
    5k Views
    DownPW
    No problem dude ! I hope you have a good vacation. Enjoy your loved ones!
  • DownPW

    Setting for high load and prevent DDoS (sysctl, iptables, crowdsec or other)

    Security security server kernel ddos iptables
    4
    0 Votes
    4 Posts
    2k Views
    phenomlab
    @DownPW most of this really depends on your desired security model. In all cases with firewalls, less is always more, although it’s never as clear cut as that, and there are always bespoke ports you’ll need to open periodically. Heztner’s DDoS protection is superior, and I know they have invested a lot of time, effort, and money into making it extremely effective. However, if you consider that the largest ever DDoS attack hit Cloudflare at 71m rps (and they were able to deflect it), and each attack can last anywhere between 8-24 hours which really depends on how determined the attacker(s) is/are, you can never be fully prepared - nor can you trace it’s true origin. DDoS attacks by their nature (Distributed Denial of Service) are conducted by large numbers of devices whom have become part of a “bot army” - and in most cases, the owners of these devices are blissfully unaware that they have been attacked and are under command and control from a nefarious resource. Given that the attacks originate from multiple sources, this allows the real attacker to observe from a distance whilst concealing their own identity and origin in the process. If you consider the desired effect of DDoS, it is not an attempt to access ports that are typically closed, but to flood (and eventually overwhelm) the target (such as a website) with millions of requests per second in an attempt to force it offline. Victims of DDoS attacks are often financial services for example, with either extortion or financial gain being the primary objective - in other words, pay for the originator to stop the attack. It’s even possible to get DDoS as a service these days - with a credit card, a few clicks of a mouse and a target IP, you can have your own proxy campaign running in minutes which typically involves “booters” or “stressers” - see below for more https://heimdalsecurity.com/blog/ddos-as-a-service-attacks-what-are-they-and-how-do-they-work @DownPW said in Setting for high load and prevent DDoS (sysctl, iptables, crowdsec or other): in short if you have any advice to give to secure the best. It’s not just about DDos or firewalls. There are a number of vulnerabilities on all systems that if not patched, will expose that same system to exploit. One of my favourite online testers which does a lot more than most basic ones is below https://www.immuniweb.com/websec/ I’d start with the findings reported here and use that to branch outwards.
  • Panda

    Interesting Widget code, but can't fetch API

    Solved Customisation nodebb
    26
    2 Votes
    26 Posts
    11k Views
    phenomlab
    @Panda said in Interesting Widget code, but can’t fetch API: How did you drop that widget into the post there? I hadnt seen this BSgenerator anywhere on sudonix site, do you use it somewhere already? Yes, here https://sudonix.org/topic/414/corporate-bullshit-generator?_=1687774393044 It’s not a “post” or “topic” in the common sense. It is actually a page in it’s own right and leverages nodebb-plugin-custom-pages. This in turn creates a new “route” which behaves like a page, meaning it is then exposed for widgets. @Panda said in Interesting Widget code, but can’t fetch API: Also can you explain more what you mean by calling the code externally. In my API call example, how would I go about doing that? By this, I mean create all the required code in an external JS file that is reachable by the NodeBB instance - so, in “public” for example - or in my case /public/js. The widget then “calls” that file and because it runs outside of the scope of NodeBB, you just need to return the values to the widget. Hope this makes sense?
  • Panda

    adding some console.log to Nodebb

    Solved Customisation nodebb
    4
    1 Votes
    4 Posts
    2k Views
    phenomlab
    @eeeee if you’re using the console, you could try node app.js > app.log 2>&1 This would redirect stdout to a file named app.log and redirect stderr to stdout. I’m not sure about standard logging under NodeBB, but there is an error log located at logs/error.log. Failing that, you could always stop the NodeBB service then use ./nodebb dev from the console which would then provide debug output.
  • mventures

    NodeBB: Favicon upload issue

    Solved Configure nodebb favicon
    12
    1
    3 Votes
    12 Posts
    4k Views
    mventures
    @phenomlab I am on a Mac, so I used the “Option + Command + I”, and then performed the steps. It loaded my favicon! I checked on Firefox which I haven’t used before, and it showed my favicon also! That’s fantastic and thank you for the help!
  • DownPW

    NodeBB 3.0 alpha1 : Error on install

    Solved Configure nodebb version 3 install error
    19
    2 Votes
    19 Posts
    7k Views
    DownPW
    @phenomlab Work now
  • crazycells

    Recent Cards plugin customization

    Solved Customisation nodebb
    21
    1
    13 Votes
    21 Posts
    12k Views
    phenomlab
    @pobojmoks that’s easily done by modifying the code provided here so that it targets background rather than border In essence, the below should work $(document).ready(function() { $(window).on('action:ajaxify.end', function(data) { $('.recent-card-container').each(function(i) { var dataId = $(this).attr("data-cid"); var color = $('[role="presentation"]', this).css("background-color"); console.log("data-cid " + dataId + " is " + color); $('[data-cid="' + dataId + '"] .recent-card').attr("style", "background-color: " + color); }); }); });
  • kurulumuNet

    nodebb dropdown menu

    Solved Configure nodebb
    5
    1
    0 Votes
    5 Posts
    3k Views
    JAC
    @phenomlab said in nodebb dropdown menu: @kurulumu-net You set it like the below example taken from this site [image: aae36790-3257-4bb2-ad5a-0d744309876a-image.png] Which presents this [image: 77f47260-2941-4afe-9614-8e17dcfc8c19-image.png] Very interesting… I actually thought this wasn’t possible, as I remember it being asked in the NodeBB forum. Is this something new that’s been implemented? I’ll 100% be doing that when I’m on the laptop over the weekend.