#DDos prevention tips.

1 messages · Page 1 of 1 (latest)

rich lily
#

I am pretty new to cloudflare and would appreciate tips on how to effectively deal with ddosing. My domains and subdomains are all proxied through cloudflare. It seems like even when i am using Under Attack Mode my website still suffers heavily from ddosing. Any advice would be helpful and i would be glad to give and relevant information on my deployment. Thanks in advanced.

#

Considering the amount of ddosing I am dealing with. Would it make sense to upgrade to pro for ddos protection?

tall silo
#

Check your server logs. If you are seeing attacks from any IP that's not on Cloudflare's IP list, then your origin IP is exposed. https://cloudflare.com/ips

rich lily
#

My attackers got the origin IP of my server before I put up a firewall only allowing inbound requests from my home network and Cloudflare's listed IP addresses

#

so i changed the origin IP AND put up a firewall preventing any access from random IP addresses

#

Basically, I already am proxied and have a firewall preventing ip access from non cloudflare IPs

#

And Bot Fight mode is on

#

All this is before asking this question ^^^

#

I did take your suggesstion and just now enabled a ratelimit

#

i will see how that does

tall silo
#

If you're on a Pro or higher plan level, you can open an Under Attack ticket and @ me with the ticket number.

#

Apart from that, I can check on the traffic for the domain but I absolutely cannot divulge any specifics except for recommending generic mitigation.

rich lily
viral scroll
#

@rich lily https://community.cloudflare.com/t/mitigating-an-http-ddos-attack-manually-with-cloudflare/302366

Cloudflare Community
Mitigating an HTTP DDoS Attack manually with Cloudflare

This guide is for those users of Cloudflare who experience medium-high level complexity DDoS attacks. Continue reading if you want to accomplish the following: Becoming more familiar with the Cloudflare Dashboard and crafting custom firewall rules. Understanding the standard behavior of DDoS attacks and deploying effective firewall rules. Rea...

rich lily
rich lily
#

In their first attacks despite spamming nearly a billion requests they seemed to have not been effective

#

because of under attack mode

viral scroll
#

just a heads up, the pro plan won't make the ddos mitigation better, however, you will get more visibility into the traffic that is reaching your site and creating firewall rules is easier

rich lily
#

yeah

#

you are right

#

and i would get access to official support tailored to my needs

rich lily
viral scroll
#

creating a ticket might help with an initial response but you wont get follow-ups fast enough, currently users that sign up for pro might wait weeks between follow-ups

#

your best bet right now is learning how to mitigate the attack

rich lily
viral scroll
#

oh absolutely

rich lily
#

I did country blocking since thats the main thing i can see

viral scroll
#

can you go to the firewall events and show me few samples of requests that were blocked/challenged?

rich lily
#

yes give me a second

#

wait maybe i should block ipv6

viral scroll
#

can you expand the events?

rich lily
#

yup

#

the user agents!

rich lily
#

the random characters

#

look at the ips

#

now the thing is i have ratelimiting on my django project

viral scroll
#

can you add a firewall rule with this expression to see if it helps?

# 
(http.request.version eq "HTTP/2" and not cf.client.bot and not http.user_agent contains "Mozilla")
rich lily
#

also

#

what action is best?

viral scroll
#

try managed challenge

#

if they bypass it, block

rich lily
#

alright, thanks man

#

now we wait

#

and see

rich lily
#

You are also in the aws discord right?

viral scroll
#

i use aws but i didnt know they had a discord channel

rich lily
rich lily
#

its because the attacker wasnt even attempting to make realistic user agents

#

they will probably realize its not working and switch it up

#

but until then its working pretty well

rich lily
#

@viral scroll unfortunately im still being ddosed pretty heavily

rich lily
#

ok

#

looks like they were targetting an api

#

so i added it to the waf ratelimit

#

big whoopsie on that one

rich lily
#

the ratelimit is whats best tho

#

thats been saving me the most

rich lily
#

@viral scroll hey whats up, i was getting ddosed again and remembered you gave me good advice to help mitigate it

#

i was wondering if you could give me some more advice now because who ever was doing it came back and became smarter

viral scroll
#

do you have some pics of the attack?

#

if you are on the pro plan go to security -> events or analytics

rich lily
#

yessir

#

i am not but I am willing to upgrade probably

#

here look

#

\an example

#

they ddos all on the query string ?id=1

#

so i just started blocking every single request with id=1

#

i need to like force every request to go thru a js challenege

#

i thought thats what under attack mode did but i was wrong

#

@viral scroll

#

The useragents are valid useragents

viral scroll
#

http 1.1 is probably a good indicator too

rich lily
#

and they are randomized

rich lily
#

yeah look

#

the rule is named after you

#

because you said i should put this in LOL

#

@viral scroll

viral scroll
#

xD nice

#

lets see if that works out

rich lily
#

its already been in there

#

the only reason my backend isnt like

#

severly crippled rn

#

is because i blocked all their requests on /?id=1

viral scroll
#

if you update to pro id open a ticket to report the missed attacks

#

wont get you inmediate help but the team can look into it

rich lily
#

yeah

#

i used to have it

#

on a different domain

#

it was pretty nice

#

@viral scroll quesiton

#

if the waf goes in order

#

how come this is not blocked by the http version filter i have

#

its blocked by a different rule

#

wait i know why

#

it only blocks if the useragent also does not contain mozilla

#

so ill remove that for now

#

yeah that worked really well for me @viral scroll good call out

#

all of those requests were on http 1.1

sleek bay
rich lily
#

Idek who they are

#

But they are attacking the same query

#

So I can just block that if I wanted to

#

LOL

sleek bay
#

Mine seem to be bypassing managed challenges completely doesn't even say they solve them

rich lily
#

Wtf

sleek bay
#

#1232493964536447017

rich lily
sleek bay
#

and thats one of my tiny attacks

rich lily
#

It’s probably something with ur config

#

Why r u getting attacked

#

Do you know?

sleek bay
#

probly the YT channel that owns us ¯_(ツ)_/¯

#

I am having a really tough time managing my issue they look like legit browser sessions they have legit looking referers, a very diverse user agent source, diverse headers

rich lily
#

look at the tls fingerprints

#

or somethign

#

or a way to like block ips if they pass a certain amoutn of rules broken

sleek bay
#

idk :/

rich lily
#

what i used to do

#

to like temp fix the problem is just disable and change the subdomain

#

LOL

#

@sleek bay

#

is it possible that your server is allowing requests from outside of cloudflare

#

on my server the only inbound requests allowed are from cf ips

sleek bay
#

both aren't possible

rich lily
#

yeah i m not an expert tbh

#

i dont know what id do in your situation

sleek bay
rich lily
#

a billion requests in a day