How to mitigate ddos attack by automatically adding the attacker IP into the deny list?

Question

Web server: nginx

I am looking for a technique to auto block an IP address when for example an attacker IP makes more than 100 requests per minute.

Link: https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/

The above article mentions about rate limiting per user based on number of requests and connections. This question is not about rate limiting but denying the IP.

There is a section about Denylisting IP Addresses in the above article - it says:

If you can identify the client IP addresses being used for an attack, you can denylist them with the deny directive so that NGINX and NGINX Plus do not accept their connections or requests.

I believe this is a manual process to observe the IP address used for an attack and then add them to the deny list. Is there a simple way to automate this?

Answer 1

See the NGINX article Mitigating DDoS Attacks with NGINX and NGINX Plus.

It lists the following methods :

• Limiting the Rate of Requests
• Limiting the Number of Connections
• Closing Slow Connections
• Denylisting IP Addresses
• Allowlisting IP Addresses
• Using Caching to Smooth Traffic Spikes
• Blocking Requests
• Limiting the Connections to Backend Servers
• Dealing with Range‑Based Attacks
• Handling High Loads
• Identifying a DDoS Attack.

Although these measures do not include an automatic mechanism to identify a DDoS Attack and adding the IPs to the Denylist, they will help protect your site.

I note that a DDOS attack is usually instigated by hundreds of thousands of attacking computers, all infected and working as zombies. It will certainly be awkward to add all their IPs to the Denylist, and their addition may slow NGINX down considerably when working normally, if it has to run through the entire list anytime that it receives a connection.