2

Web server: nginx

I am looking for a technique to auto block an IP address when for example an attacker IP makes more than 100 requests per minute.

Link: https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/

The above article mentions about rate limiting per user based on number of requests and connections. This question is not about rate limiting but denying the IP.

There is a section about Denylisting IP Addresses in the above article - it says:

If you can identify the client IP addresses being used for an attack, you can denylist them with the deny directive so that NGINX and NGINX Plus do not accept their connections or requests.

I believe this is a manual process to observe the IP address used for an attack and then add them to the deny list. Is there a simple way to automate this?

3
  • 1
    Keep in mind that mitigating DDoS attacks is often not possible at the attacked host itself but must be done at some firewall further out.
    – Daniel B
    Jul 12, 2022 at 8:46
  • You're looking for a WAF.
    – gronostaj
    Jul 12, 2022 at 8:51
  • Any reference to what is this WAF?
    – variable
    Jul 12, 2022 at 12:08

1 Answer 1

4

See the NGINX article Mitigating DDoS Attacks with NGINX and NGINX Plus.

It lists the following methods :

  • Limiting the Rate of Requests
  • Limiting the Number of Connections
  • Closing Slow Connections
  • Denylisting IP Addresses
  • Allowlisting IP Addresses
  • Using Caching to Smooth Traffic Spikes
  • Blocking Requests
  • Limiting the Connections to Backend Servers
  • Dealing with Range‑Based Attacks
  • Handling High Loads
  • Identifying a DDoS Attack.

Although these measures do not include an automatic mechanism to identify a DDoS Attack and adding the IPs to the Denylist, they will help protect your site.

I note that a DDOS attack is usually instigated by hundreds of thousands of attacking computers, all infected and working as zombies. It will certainly be awkward to add all their IPs to the Denylist, and their addition may slow NGINX down considerably when working normally, if it has to run through the entire list anytime that it receives a connection.

4
  • So slowing down the ddos attack is the only solution?
    – variable
    Jul 12, 2022 at 12:08
  • That's one of the measures designed to lighten the DDOS burden on the server.
    – harrymc
    Jul 12, 2022 at 12:15
  • Is there anything else as part of nginx? or outside of nginx that I can do?
    – variable
    Jul 12, 2022 at 12:40
  • Just keep an eye on things. If this is a commercial website, you could invest in a commercial content delivery network (CDN) such as Cloudflare.
    – harrymc
    Jul 12, 2022 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .