1

Description of the Situation:

Let's say 1000 "known" clients/workers are collecting time-sensitive data from the field and sending to a server. Therefore, we need to secure the server from DDoS attacks at a specific day and period of nearly 3 hours. It is expected to have DDoS attack during this process.

Question: What are the possible ways of securing this process for that critical period of time? Maybe load balancing + firewall for allowing only 1000 "known" IP addresses ... etc?

  • 5
    What's stopping you from using a cloud service as DoS protection? – MechMK1 May 27 at 13:04
  • 2
    "small number of known clients" = 1000 clients? That's not a small number. – schroeder May 27 at 16:09
  • Frankly, I'd consider distributing your collection system. Launch multiple VMs in the cloud and distribute requests to those VMs. Or, better yet, give your clients the IPs to a distribution of those IPs. Funnel data on the backend to your central repo. If you only need it for 3 hours, it should be low-cost. In this way, a DDoS attacker would have to know all your IPs. I assume they might only know one or two. – schroeder May 27 at 16:28
  • 1
    If your server is using static IP(s) known to the attacker, basically it is a sitting duck. Unless you are an ISP that able to directly sinkhole IP traffics and pop another IP for your server (and not publish the new IP in your DNS server) Otherwise you need DDoS protection / IP mitigation tactics (alternate ISP line ) / put your services into cloud platform and alternating IP to evade the attack. – mootmoot May 27 at 16:52
  • @MechMK1 cloud service as DDoS protection was not that successful in the past. It will be utilized again but alternative solutions like random IP-Hopping or honey pot published as the another address or something else is considered. Searching for alternative ways here. – fermat4214 May 28 at 17:21
1

I would whitelist in the Firewall the known IPs (it can be done in minutes if you already have the IPs even if they are 1000). That would make sure anything else trying to connect will be automatically rejected.

In a CISCO firewall this certainly would work fine. An ASA if with a Content Security and Control Security Service module then you may enable signatures as well to mitigate DOS/DDOS/SYN-FLOOD.

Additionally, in the case of a Linux machine, you could just enable fail2ban and get rid of anything unwanted.

In the good case scenario, your server is behind a Firewall and you put filters on both the firewall and server machine.

0

If you're using Linux Apache you can whitelist a list of IP addresses to access the server in htaccess, essentially banning everyone but your clients.

If you use this method, simply change the htaccess file on days when you need to ban everyone but your clients, and change it back on days when you want to give access to the world as well. You can even automate the htaccess updates in PHP if you want to get fancy and don't want to make the changes manually.

Htaccess IP banning is how websites combat DDoS attacks, and is pretty much the only reliable method that is used. You can learn more about htaccess IP banning at stackoverflow, as there is much written on the subject. The only other common method of stopping DDoS is to use a service such as Cloudflare which detects the IP address of users before they access your website. If the IP address is a known DDoS attacker, Cloudflare bans them from accessing your site.

However, if you know the specific IP addresses of the people DDoSing you, all you have to do is ban those exact IP addresses in htaccess. This is how almost every major website combats DDoS. You can find the IP addresses of DDoS attacks by looking over the logs on your server.

  • 1
    If the volume of the expected attack is huge, will that whitelist work? Even if the whitelist is used, Is it possible to consume the resources of the server by just trying to access the server by the attacker bots (they will be rejected since their IP addresses are not in the whitelist). What is the burden on the server to check the whitelist? Should it be accompanied by load balancer? – fermat4214 May 27 at 14:47
  • 1
    "Htaccess IP banning is how websites combat DDoS attacks" "This is how almost every major website combats DDoS" - citation needed. Local system blocking does not stop DDoS. DoS? Sure. – schroeder May 27 at 16:15
  • Do your own research schroeder, why would people have to provide citations on their posts in this stack? Here is a citation... view the accepted answer... stackoverflow.com/questions/17078091/… It'd be nice if my negative score would be undone. Because I'm not going to contribute excellent content to this stack if I'm punished for it. PS, I was the #2 reputation earner for webmaster.stackexchange for 2018. And DDoS/htaccess is a common topic. – Michael d May 28 at 7:14
  • 1
    Fermat, your server will receive some load for the htaccess request from the DDoS bots. However, this is much less load than the bots requesting URLs on your server. There are also ways to prevent bots from requesting the htaccess file too many times in 1 minute. I believe you can do this with caching. Or if you're really concerned about it and htaccess doesn't work, you can use a firewall or cloudflare to block the IPs before they even request your htaccess. But Htaccess is where just about everyone starts in blocking bad bots. I've experienced many DDoS attacks. Htaccess helps enormously. – Michael d May 28 at 7:18
  • A serious DDoS will bring down the network first before it reach the server. – mootmoot May 29 at 8:47
0

If it was me, and I had source of the server & permission to modify it, I would configure the server as following:

  1. there is a blacklist on the server side & there is a blacklist on firewall
  2. a connection to the server is allowed if it has tried logging in less than three (n) times
  3. if more than 3 times the IP failed to login, server refuse to accept any other request from that IP (add to local blacklist)
  4. even more, server calls edge firewall api and request the blocking from upper firewall (add to remote blacklist)
  5. any other unreasonable behavior such as n requests in k seconds should be monitored and sent to blacklists.
  • I don't think endpoint firewall/WAF capable to tackle with massive DDoS traffic. – mootmoot May 28 at 14:14
  • It really depends on its specs. I can't tell you if I think it can handle or not, but I can tell you a well configured firewall can help. And it really depends how you block traffic, to tell how many process the firewall does. – FarhadGh May 29 at 6:56
  • IMHO, DDoS is a routing challenge. The good old "Cisco firewall advise" is not effective against DDoS attack like this. krebsonsecurity.com/2018/05/… – mootmoot May 29 at 8:50
  • I'm not talking about Cisco specifically. There are always a worst happened situation.The way told here is Ideal for most sites with already known traffic culture. And last of all, Every solution has trade offs. It's not perfect, no other one is so. You can try adding your solution too, to improve the average answer. – FarhadGh May 29 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.