Problem with layer 7 attack

nullroute · October 2020

Hello my dear friends of this beloved forum.
As everyone knows, most schools, if not all schools are closed and with that all the kids are on the loose (burn the witch)!
I work with sales of minecraft hosting and recently I am having problems with DDoS Layer 7 attacks that make my php-fpm just overflow CPU usage.
I use nginx + php fpm.

I need urgent help to remedy this problem. I will be grateful for those who help me.

Here is a screenshot of the attack:

MaxKVM · October 2020

You might have a few options with nginx: https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/

limit_req_zone and/or limit_conn_zone for location /sistema/ { } should help.

nullroute · October 2020

@MaxKVM said:
You might have a few options with nginx: https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/

limit_req_zone and/or limit_conn_zone for location /sistema/ { } should help.

I use cPanel shared hosting, unfortunately I can't make this change.

I put the site on the cloudflare network, but it seems that the captcha cannot stop the bots.

donko · October 2020

have you tried enabling constant captcha challenge with a firewall rule instead using javascript challenge from under attack mode?

nullroute · October 2020

@donko said:
have you tried enabling constant captcha challenge with a firewall rule instead using javascript challenge from under attack mode?

Yes, I am using the challenge (captcha) and yet thousands of requests go through the CF network.

sanvit · October 2020

Well, your domain doesn't seem to go through CF's network and exposes your IP (185.62..). It's not enough to just point your nameservers to CF. You have to click the cloud icon and make it orange (set it to route through CF's networks) and change your origin IP as your old IP is already exposed

sanvit · October 2020

nullroute · October 2020

@sanvit said:
Well, your domain doesn't seem to go through CF's network and exposes your IP (185.62..). It's not enough to just point your nameservers to CF. You have to click the cloud icon and make it orange (set it to route through CF's networks) and change your origin IP as your old IP is already exposed

I already removed my website from the cloudflare, I would not be a layman to a certain extent of not activating the orange cloud.

sonic · October 2020

@nullroute said:

@sanvit said:
Well, your domain doesn't seem to go through CF's network and exposes your IP (185.62..). It's not enough to just point your nameservers to CF. You have to click the cloud icon and make it orange (set it to route through CF's networks) and change your origin IP as your old IP is already exposed

I already removed my website from the cloudflare, I would not be a layman to a certain extent of not activating the orange cloud.

Move your site to BuyVM VPS with ddos protection.

seriesn · October 2020

@nullroute said:

@sanvit said:
Well, your domain doesn't seem to go through CF's network and exposes your IP (185.62..). It's not enough to just point your nameservers to CF. You have to click the cloud icon and make it orange (set it to route through CF's networks) and change your origin IP as your old IP is already exposed

I already removed my website from the cloudflare, I would not be a layman to a certain extent of not activating the orange cloud.

Serious question my friend,
On a shared hosting server, how else do you plan to filter layer 7 attacks?

hey · October 2020

how about blocking the referrer? since they use the same referrer on both of your screenshots

nullroute · October 2020

@sonic said:

@nullroute said:

@sanvit said:
Well, your domain doesn't seem to go through CF's network and exposes your IP (185.62..). It's not enough to just point your nameservers to CF. You have to click the cloud icon and make it orange (set it to route through CF's networks) and change your origin IP as your old IP is already exposed

I already removed my website from the cloudflare, I would not be a layman to a certain extent of not activating the orange cloud.

Move your site to BuyVM VPS with ddos protection.

Layer 7 attacks do not directly affect the network, but the application, layer 3/4 protection does not protect layer 7.

nullroute · October 2020

@hey said:
how about blocking the referrer? since they use the same referrer on both of your screenshots

How to do this?

sonic · October 2020

@nullroute said:

@sonic said:

@nullroute said:

@sanvit said:
Well, your domain doesn't seem to go through CF's network and exposes your IP (185.62..). It's not enough to just point your nameservers to CF. You have to click the cloud icon and make it orange (set it to route through CF's networks) and change your origin IP as your old IP is already exposed

I already removed my website from the cloudflare, I would not be a layman to a certain extent of not activating the orange cloud.

Move your site to BuyVM VPS with ddos protection.

Layer 7 attacks do not directly affect the network, but the application, layer 3/4 protection does not protect layer 7.

BuyVM filtered-IP is very good at Layer 7 protection.

MikeA · October 2020

BuyVM filtered-IP is very good at Layer 7 protection.

Since CloudFlare can't mitigate HTTPS I doubt CloudFlare transit can.

yoursunny · October 2020

My website is setup with two nginx sites. The frontend site is a reverse proxy to the backend site and has 1-hour cache; the backend site listens on localhost and runs php-fpm.
If someone repeatedly request a page, these requests are answered by the cache and not PHP.

splitice · October 2020

If it's not handled by default we offer all customers custom Layer 7 mitigation rules. I'm happy to help write the rule when I have time if you are not able. It looks like it would be a very simple rule on any number of attributes.

https://www.x4b.net/kb/Layer7Rules

Problem with layer 7 attack

Comments