1

I'm sure you all know what Cloudflare is (it's a very famous CDN).

What I want to do, is force my Apache HTTP server to ONLY answer to Cloudflare. I want Apache to ignore and close or not respond to any incoming socket that doesn't match a list of IPs. (in the Apache cor level, before reaching PHP etc)

I need this to protect my website from DoS/DDoS incase someone got my real webserver's IP.

I have this guy that creates like 1200 TCP connexions to my webserver, and these connexions don't send anything, they just stay open and alive, which makes my webserver down for a while.

I'm a total newbie at Apache configuration etc, I need a step by step Instructions. I'm using Windows Server 2008.

3
  • Doing this won't prevent DoS/DDoS attacks.
    – Ramhound
    Jun 12, 2012 at 18:30
  • @Ramhound That depends on the attack. If he's being SYN flooded, then switching to a whitelist using a firewall will prevent him from being hit by that particular attack (assuming he protects all open ports). You are right in that it won't stop all attacks though. Jun 12, 2012 at 19:55
  • Maybe also put something in front of Apache (like NginX) to stop Slowloris attacks?
    – Vi.
    Jul 7, 2014 at 0:53

3 Answers 3

2

We (CloudFlare) put something up for this in our knowledge base yesterday for Apache.

5
  • Woow you guys are everywhere ! Thank's, but using this will print a "Forbidden page error", is there anychance I can force sockets to not be created in Apache ? (To make it seem like there is no webserver hosted on my IP)
    – Reacen
    Jun 13, 2012 at 6:44
  • This is great that there are companies which support their customers like this :) @Reacen To make it seem like there's no webserver, you must drop the packets with a firewall before they get to apache. The only way apache can know to block is by first opening the socket and seeing who is there, while a firewall can look into the packets directly before the socket is opened. Not only will it look like no webserver on port 80, but the whole computer will be invisible on port 80. Jun 13, 2012 at 14:16
  • Thanks for just posting a link, which is now dead. It's really cool that CloudFlare can't be bothered to follow community guidelines.
    – Kerin
    Dec 10, 2013 at 17:44
  • That link was posted well over a year ago. Our support system changed last year to a new Content Management system & the link changed. It isn't a violation of community guidelines at all because a link changed. We actually don't recommend restricting to our IPs only, unless something really, really is wrong. It can cause issues for your site if you pause us, which means we are the going direct to your server, so it won't accept connections because it is not our IP. Dec 16, 2013 at 23:34
  • 1
    "There isn’t a Tender here!" Can you update a link?
    – the
    Aug 4, 2014 at 9:36
3

If you want to restrict access to your port 80 to a specific list of IPs, then you should look into using iptables (presuming linux) or another firewalling solution to drop all incoming connections to port 80 which are not from IPs on the whitelist.

1
  • That is a great idea! I hope Windows's firewall can allow this, thank you very much
    – Reacen
    Jun 13, 2012 at 6:46
-1

This might help you :

If you want to restrict access to your port 80 to a specific list of IPs, then you should look into using iptables (presuming linux) or another firewalling solution to drop all incoming connections to port 80 which are not from IPs on the whitelist.

DDOS – Instant Protection with CloudFlare

1
  • Aside from the link, this is word for word identical to one of the answers from three years ago.  Please don’t post an answer unless you actually have something new to contribute. May 29, 2015 at 6:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .