Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm sure you all know what Cloudflare is (it's a very famous CDN).

What I want to do, is force my Apache HTTP server to ONLY answer to Cloudflare. I want Apache to ignore and close or not respond to any incoming socket that doesn't match a list of IPs. (in the Apache cor level, before reaching PHP etc)

I need this to protect my website from DoS/DDoS incase someone got my real webserver's IP.

I have this guy that creates like 1200 TCP connexions to my webserver, and these connexions don't send anything, they just stay open and alive, which makes my webserver down for a while.

I'm a total newbie at Apache configuration etc, I need a step by step Instructions. I'm using Windows Server 2008.

share|improve this question
    
Doing this won't prevent DoS/DDoS attacks. –  Ramhound Jun 12 '12 at 18:30
    
@Ramhound That depends on the attack. If he's being SYN flooded, then switching to a whitelist using a firewall will prevent him from being hit by that particular attack (assuming he protects all open ports). You are right in that it won't stop all attacks though. –  Darth Android Jun 12 '12 at 19:55
    
Maybe also put something in front of Apache (like NginX) to stop Slowloris attacks? –  Vi. Jul 7 at 0:53

2 Answers 2

up vote 1 down vote accepted

We (CloudFlare) put something up for this in our knowledge base yesterday for Apache.

share|improve this answer
    
Woow you guys are everywhere ! Thank's, but using this will print a "Forbidden page error", is there anychance I can force sockets to not be created in Apache ? (To make it seem like there is no webserver hosted on my IP) –  Reacen Jun 13 '12 at 6:44
    
This is great that there are companies which support their customers like this :) @Reacen To make it seem like there's no webserver, you must drop the packets with a firewall before they get to apache. The only way apache can know to block is by first opening the socket and seeing who is there, while a firewall can look into the packets directly before the socket is opened. Not only will it look like no webserver on port 80, but the whole computer will be invisible on port 80. –  Darth Android Jun 13 '12 at 14:16
    
Thanks for just posting a link, which is now dead. It's really cool that CloudFlare can't be bothered to follow community guidelines. –  Kerin Dec 10 '13 at 17:44
    
That link was posted well over a year ago. Our support system changed last year to a new Content Management system & the link changed. It isn't a violation of community guidelines at all because a link changed. We actually don't recommend restricting to our IPs only, unless something really, really is wrong. It can cause issues for your site if you pause us, which means we are the going direct to your server, so it won't accept connections because it is not our IP. –  damoncloudflare Dec 16 '13 at 23:34
1  
"There isn’t a Tender here!" Can you update a link? –  Kasper Souren Aug 4 at 9:36

If you want to restrict access to your port 80 to a specific list of IPs, then you should look into using iptables (presuming linux) or another firewalling solution to drop all incoming connections to port 80 which are not from IPs on the whitelist.

share|improve this answer
    
That is a great idea! I hope Windows's firewall can allow this, thank you very much –  Reacen Jun 13 '12 at 6:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.