Skip to content
Sudonix

how to prevent DDoS attacks ?

Solved Vulnerability
34 2 13.5k 1
  • crazycells crazycells

    @phenomlab on a side note, is there any easy way to implement a rule… to allow only two geolocation (countries) but block the access from the rest of the countries?

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #22

    @crazycells yes, but without Cloudflare you’d need to perform more checks to determine traffic origin before you have make a decision as to block or permit.

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells yes, but without Cloudflare you’d need to perform more checks to determine traffic origin before you have make a decision as to block or permit.

    crazycells
    crazycells
    crazycells
    wrote on
    #23

    @phenomlab yes, we are planning to install Cloudflare again…

    We will go with “Pro” version and see how it works, I guess this should help not to have any session errors… Previously, we got many connection problems because of Cloudflare…

    0
  • crazycells crazycells

    @phenomlab yes, we are planning to install Cloudflare again…

    We will go with “Pro” version and see how it works, I guess this should help not to have any session errors… Previously, we got many connection problems because of Cloudflare…

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #24

    @crazycells I wouldn’t be so sure. The pro version of Cloudflare is $20 per month but I don’t think that will resolve the connectivity issues.

    There also the harm that CF causes to SEO if you use their bot fight mode as I mention here

    https://sudonix.org/topic/503/cloudflare-bot-fight-mode-and-google-search

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells I wouldn’t be so sure. The pro version of Cloudflare is $20 per month but I don’t think that will resolve the connectivity issues.

    There also the harm that CF causes to SEO if you use their bot fight mode as I mention here

    https://sudonix.org/topic/503/cloudflare-bot-fight-mode-and-google-search

    crazycells
    crazycells
    crazycells
    wrote on
    #25

    @phenomlab I have a good news. We set up CloudFlare Pro, and did not have connection problems yet.

    As you said, it costs $20/month if you subscribe annually, but we did monthly ($25) since we were not sure if this will work for us. So far everything looks OK. We will also check “Google Search” problem you mentioned as well after we secure our forum. Thanks a lot for this warning!

    Unfortunately, we had no choice about Cloudflare since we were getting more than 1 billion connection request from bots and forum was unusable for several hours two consecutive days…

    Screen Shot 2023-11-15 at 16.49.45.png

    Screen Shot 2023-11-18 at 13.22.28.png

    Screen Shot 2023-11-18 at 13.24.55.png

    crazycells phenomlab 2 Replies
    1
  • crazycells crazycells

    @phenomlab I have a good news. We set up CloudFlare Pro, and did not have connection problems yet.

    As you said, it costs $20/month if you subscribe annually, but we did monthly ($25) since we were not sure if this will work for us. So far everything looks OK. We will also check “Google Search” problem you mentioned as well after we secure our forum. Thanks a lot for this warning!

    Unfortunately, we had no choice about Cloudflare since we were getting more than 1 billion connection request from bots and forum was unusable for several hours two consecutive days…

    Screen Shot 2023-11-15 at 16.49.45.png

    Screen Shot 2023-11-18 at 13.22.28.png

    Screen Shot 2023-11-18 at 13.24.55.png

    crazycells
    crazycells
    crazycells
    wrote on
    #26

    @crazycells well, of course 1 billion+ requests happened after we installed CF, I do not know how many more we had before installing CF…

    1
  • crazycells crazycells

    @phenomlab I have a good news. We set up CloudFlare Pro, and did not have connection problems yet.

    As you said, it costs $20/month if you subscribe annually, but we did monthly ($25) since we were not sure if this will work for us. So far everything looks OK. We will also check “Google Search” problem you mentioned as well after we secure our forum. Thanks a lot for this warning!

    Unfortunately, we had no choice about Cloudflare since we were getting more than 1 billion connection request from bots and forum was unusable for several hours two consecutive days…

    Screen Shot 2023-11-15 at 16.49.45.png

    Screen Shot 2023-11-18 at 13.22.28.png

    Screen Shot 2023-11-18 at 13.24.55.png

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #27

    @crazycells Good news in the short term, but interested to see if this does impact the SEO of your forum. Do you have Bot Fight Mode enabled in CF?

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells Good news in the short term, but interested to see if this does impact the SEO of your forum. Do you have Bot Fight Mode enabled in CF?

    crazycells
    crazycells
    crazycells
    wrote on
    #28

    @phenomlab I actually do not know yet, because I have not found these settings on the CF yet…

    Can you please show me how I reach those?

    Screen Shot 2023-11-21 at 16.27.14.png

    and this is the bot page:

    Screen Shot 2023-11-21 at 16.29.47.png

    0
  • crazycells crazycells

    @phenomlab I actually do not know yet, because I have not found these settings on the CF yet…

    Can you please show me how I reach those?

    Screen Shot 2023-11-21 at 16.27.14.png

    and this is the bot page:

    Screen Shot 2023-11-21 at 16.29.47.png

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #29

    @crazycells see the link located at the top right of that screenshot 😂

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells see the link located at the top right of that screenshot 😂

    crazycells
    crazycells
    crazycells
    wrote on
    #30

    @phenomlab lol thanks…

    Mouxy Cotorep GIF

    is it “Verified bots”?

    Screen Shot 2023-11-21 at 16.54.43.png

    😂
    0
  • crazycells crazycells

    @phenomlab lol thanks…

    Mouxy Cotorep GIF

    is it “Verified bots”?

    Screen Shot 2023-11-21 at 16.54.43.png

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #31

    @crazycells yes, exactly. You want to allow crawlers such as Google bot etc.

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells yes, exactly. You want to allow crawlers such as Google bot etc.

    crazycells
    crazycells
    crazycells
    wrote on
    #32

    @phenomlab thanks. so, it looks like we are good for now…

    is there any other way to verify independently that indexing works ok?

    0
  • crazycells crazycells

    @phenomlab thanks. so, it looks like we are good for now…

    is there any other way to verify independently that indexing works ok?

    phenomlab
    phenomlab
    phenomlab
    wrote on
    #33

    @crazycells the only accurate way is to use the URL Inspection Tool

    https://support.google.com/webmasters/answer/9012289?hl=en

    Mark Cutting also advises organisations as a Fractional CIO, Fractional CISO and Executive Advisor, helping boards improve technology governance, cyber resilience and executive decision making. Learn more at Gratmore Ltd

    1
  • phenomlab phenomlab

    @crazycells the only accurate way is to use the URL Inspection Tool

    https://support.google.com/webmasters/answer/9012289?hl=en

    crazycells
    crazycells
    crazycells
    wrote on
    #34

    @phenomlab thank you very much, this was helpful. Everything looks ok 🙂

    1
  • crazycells crazycells has marked this topic as solved on
Log in to reply

Did this solution help you?
Did you find the suggested solution useful? Support 💗 Sudonix with a coffee ☕
If your organisation needs deeper expertise around infrastructure, security, or technology leadership, learn more about Phenomlab Ltd. Many of the deeper technical guides behind Sudonix are published there.

Related Topics
  • Panda

    Nodebb and emails

    Solved Configure nodebb
    27
    5 Votes
    27 Posts
    10k Views
    phenomlab
    @Panda it will use SMTP. In all cases, I never use any plugin to send email. I’ll always send it raw.
  • DownPW

    Glitch effect when refreshing the home page

    Customisation javascript nodebb customisation glitch effect
    17
    14 Votes
    17 Posts
    5k Views
    DownPW
    No problem dude ! I hope you have a good vacation. Enjoy your loved ones!
  • DownPW

    Setting for high load and prevent DDoS (sysctl, iptables, crowdsec or other)

    Security security server kernel ddos iptables
    4
    0 Votes
    4 Posts
    2k Views
    phenomlab
    @DownPW most of this really depends on your desired security model. In all cases with firewalls, less is always more, although it’s never as clear cut as that, and there are always bespoke ports you’ll need to open periodically. Heztner’s DDoS protection is superior, and I know they have invested a lot of time, effort, and money into making it extremely effective. However, if you consider that the largest ever DDoS attack hit Cloudflare at 71m rps (and they were able to deflect it), and each attack can last anywhere between 8-24 hours which really depends on how determined the attacker(s) is/are, you can never be fully prepared - nor can you trace it’s true origin. DDoS attacks by their nature (Distributed Denial of Service) are conducted by large numbers of devices whom have become part of a “bot army” - and in most cases, the owners of these devices are blissfully unaware that they have been attacked and are under command and control from a nefarious resource. Given that the attacks originate from multiple sources, this allows the real attacker to observe from a distance whilst concealing their own identity and origin in the process. If you consider the desired effect of DDoS, it is not an attempt to access ports that are typically closed, but to flood (and eventually overwhelm) the target (such as a website) with millions of requests per second in an attempt to force it offline. Victims of DDoS attacks are often financial services for example, with either extortion or financial gain being the primary objective - in other words, pay for the originator to stop the attack. It’s even possible to get DDoS as a service these days - with a credit card, a few clicks of a mouse and a target IP, you can have your own proxy campaign running in minutes which typically involves “booters” or “stressers” - see below for more https://heimdalsecurity.com/blog/ddos-as-a-service-attacks-what-are-they-and-how-do-they-work @DownPW said in Setting for high load and prevent DDoS (sysctl, iptables, crowdsec or other): in short if you have any advice to give to secure the best. It’s not just about DDos or firewalls. There are a number of vulnerabilities on all systems that if not patched, will expose that same system to exploit. One of my favourite online testers which does a lot more than most basic ones is below https://www.immuniweb.com/websec/ I’d start with the findings reported here and use that to branch outwards.
  • Panda

    Fixed background to nodebb forum

    Solved Configure nodebb
    25
    4 Votes
    25 Posts
    10k Views
    phenomlab
    @Panda said in Fixed background to nodebb forum: Chatgpt told me the ::before method. Go figure
  • Panda

    Further Widgets question

    Solved Configure nodebb
    4
    1
    1 Votes
    4 Posts
    2k Views
    phenomlab
    @Panda category is for a category in its own, so for example, “fruit” whereas categories is the page that contains all categories as a list.
  • cagatay

    Header Menu After Upgrading V3.1.1

    Solved Customisation header nodebb
    2
    1
    2 Votes
    2 Posts
    1k Views
    phenomlab
    @cagatay this relates to a change the css classes used for the brand header meaning it will now float to the left instead of right. If you’d like to retain the original behavior, you can add this css class [data-widget-area="brand-header"] { justify-content: end; display: flex; } Further information here https://community.nodebb.org/topic/17090/manual-build-a-custom-header-in-harmony/19?_=1684069325296
  • cagatay

    NodeBB v3

    Announcements nodebb v3 nodebb
    2
    3 Votes
    2 Posts
    1k Views
    phenomlab
    @cagatay JS will work fine - no changes there, and there are no plans to drop support for jQuery. More of an issue is the CSS - for which there are quite a few breaking changes. Keep an eye on sudonix.dev (my development site) where you can see progress in relation to how I am tackling the compatibility issues.
  • Panda

    Title on homepage of nodebb forum

    Solved Customisation nodebb
    2
    1 Votes
    2 Posts
    2k Views
    phenomlab
    @eveh Welcome board The code you are referring to is custom written as no such functionality exists under NodeBB. However, adding the functionality is relatively trivial. Below are the required steps Navigate to /admin/appearance/customise#custom-header Add the below code to your header, and save once completed <ol id="mainbanner" class="breadcrumb"><li id="addtext">Your Title Goes Here</li></ol> Navigate to /admin/appearance/customise#custom-js and add the below code, then save $(document).ready(function() { $(window).on('action:ajaxify.end', function(data) { // Initialise mainbanner ID, but hide it from view $('#mainbanner').hide(); var pathname = window.location.pathname; if (pathname === "/") { $("#addtext").text("Your Title"); $('#mainbanner').show(); } else {} // If we want to add a title to a sub page, uncomment the below and adjust accordingly //if (pathname === "/yourpath") { //$("#addtext").text("Your Title"); //$('#mainbanner').show(); //} }); }); Navigate to /admin/appearance/customise#custom-css and add the below CSS block .breadcrumb { right: 0; margin-right: auto; text-align: center; background: #0086c4; color: #ffffff; width: 100vw; position: relative; margin-left: -50vw; left: 50%; top: 50px; position: fixed; z-index: 1020; } Note, that you will need to adjust your CSS code to suit your own site / requirements.