Website Currently under DoS Attack

This is currently happening to my forum which fucking sucks.
It's been down for 2h and someone placed a 10GB attack. >.<

Cloudfare is really shit

If it is Layer 7, I would use Sucuri. It protects against that.

You probably already got support but eh just saying.

29-02-2016, 06:10 AM

Zenith Wrote: Cloudfare is really shit

If it is Layer 7, I would use Sucuri. It protects against that.

You probably already got support but eh just saying.

I looked at that, looks a bit pricy.
Any other services that do this, that have a free plan? :yus:

29-02-2016, 06:13 AM

Tropical Wrote:

29-02-2016, 06:10 AM

Zenith Wrote: Cloudfare is really shit

If it is Layer 7, I would use Sucuri. It protects against that.

You probably already got support but eh just saying.

I looked at that, looks a bit pricy.
Any other services that do this, that have a free plan? :yus:

I do not know of a free plan. sorry. Idk which ones are good though. lol

Yeah man we went with Sucuri for $20 a month, we have been doing fine.

29-02-2016, 06:41 AM

Strange Leader Wrote: Yeah man we went with Sucuri for $20 a month, we have been doing fine.

Check your messages. :noh:

Okay this going to be a long post on how to stop big DDoS attacks

1. Ban the User Agents

Find the user agents they are using to connect to your server. Some botnets will have similar user so take advantage of that. Use fail2ban or any other ip limiting system to ban the user agents. Use a wildcard.

2. Limit connection per ip

You could limit the connect per ip down to like 1 per 5 seconds. This will definitely effect the DDoS attack.

3. Simply ban the ips

You've been under attack for 16 hours. Get all IPs that have been hitting or pinging your server more than 5-10 hours and ban the ip from the server using fail2ban.

4. Mitigate it

Get another server to take the load. Your server doesn't have to take the hit if you have another server to take the hit instead.

5. Finally get a proper firewall

It can even be a Digitalocean server that is acting as a firewall. I have 3 layers on my site. It goes like this. Cloudflare ---> Firewall ---> Site
I change the name server to Cloudflare on the domain registrar, then from Cloudflare I point all my DNS records to my firewall. Then on my firewall I redirect them to my server IP. Therefore it goes through 2 layers before even reaching my origin server. Also make your firewall unpingable.

Might be some spelling or grammar mistakes, I'm very tired.

Try this and good luck.

Use Under Attack mode?

29-02-2016, 09:12 PM

Growl Wrote: Okay this going to be a long post on how to stop big DDoS attacks

1. Ban the User Agents

Find the user agents they are using to connect to your server. Some botnets will have similar user so take advantage of that. Use fail2ban or any other ip limiting system to ban the user agents. Use a wildcard.

2. Limit connection per ip

You could limit the connect per ip down to like 1 per 5 seconds. This will definitely effect the DDoS attack.

3. Simply ban the ips

You've been under attack for 16 hours. Get all IPs that have been hitting or pinging your server more than 5-10 hours and ban the ip from the server using fail2ban.

4. Mitigate it

Get another server to take the load. Your server doesn't have to take the hit if you have another server to take the hit instead.

5. Finally get a proper firewall

It can even be a Digitalocean server that is acting as a firewall. I have 3 layers on my site. It goes like this. Cloudflare ---> Firewall ---> Site
I change the name server to Cloudflare on the domain registrar, then from Cloudflare I point all my DNS records to my firewall. Then on my firewall I redirect them to my server IP. Therefore it goes through 2 layers before even reaching my origin server. Also make your firewall unpingable.

Might be some spelling or grammar mistakes, I'm very tired.

Try this and good luck.

I am actually gonna try some of these like mitigating the server when I get home. :yus:

12-02-2016, 06:58 PM

Strange Leader Wrote: So uh my forum has been down for like 16 hours now, and I was just wondering if anyone knew of any good security measures I could use to get it back.
think it's a layer 7 ddos attack, and that goes by cloudflare. Pretty sure it is just a couple kids having laughs from a competitor forum or something. Well, my forum is like brand new so it's kinda dumb but yeh. I mean I got cloudflare free but that obviously is not going to so a thing

Sorry kinda don't know anything about stopping ddos attacks

Stop using shit like cloudflare. If you really want help pm me on skype.