Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is my web server being attacked?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Ask HN: Why is my web server being attacked?

#21

Post by naiv »

piperswe wrote: post #18
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

If you set up Cloudflare Tunnel, you don't even need to be set up to accept any incoming connections. With Access, you can even run SSH through that tunnel. You can then setup your firewall to drop any incoming packets for non-established connections, closing a significant hole for DoS attacks and such.

Tailscale is also a great alternative

Re: Ask HN: Why is my web server being attacked?

#22

Post by solardev »

codegeek wrote: post #15
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

Cloudflare won't protect your IP being hit directly. If your IP can be accessed publicly, it will get hit. period. You could use nginx etc to do a 444 status code but can't stop these scripts/bots from hitting ur IP completely.

Normally you'd just configure the firewall to drop all packets not from Cloudflare. Maybe also get a new static IP first.

Re: Ask HN: Why is my web server being attacked?

#24

Post by lormayna »

codegeek wrote: post #15
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

Cloudflare won't protect your IP being hit directly. If your IP can be accessed publicly, it will get hit. period. You could use nginx etc to do a 444 status code but can't stop these scripts/bots from hitting ur IP completely.

Yes and no. If you have an iptables rule that drop anything not coming from CF IPs, the attacking packets are not passed to the application and dropped in kernel mode. Otherwise the packet will be passed to user mode application that consume more resources to analyse and drop the connection.

Re: Ask HN: Why is my web server being attacked?

#25

Post by francisofascii »

gtirloni wrote: post #8

One hundred. Not great, not terrible. Take him to the infirmary. Toptunov, take him! He's delusional. Flood attack, forged IP addresses. He'll be fine. I've seen worse. You didn't see forged IPs. You didn't. You didn't!!! Because it's not there!

The meter max reading is 100. It's not 100. It's 15,000. :)

Re: Ask HN: Why is my web server being attacked?

#26

Post by ericbarrett »

While I agree with other commenters that 100/hour doesn't rise to the level of "attack," I'm also curious, because with a forged peer address these are certainly not probes—the true sender would not get a response either way. Unless, that is, the spoofed IPs are also controlled by the attacker. I wonder if you'd find any patterns (net range, ASN, geographical, residential, etc.) in an analysis.

It could also be that your server—no doubt along with millions of others—is simply being used as a bouncer to shield the origin of a DDoS attack. Typically attackers want "amplification" (send a tiny packet with a spoofed source address, get a large response) but if their pipe is big enough they may be content with a level of indirection.

Re: Ask HN: Why is my web server being attacked?

#27

Post by [deleted] »

codegeek wrote: post #15
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

Cloudflare won't protect your IP being hit directly. If your IP can be accessed publicly, it will get hit. period. You could use nginx etc to do a 444 status code but can't stop these scripts/bots from hitting ur IP completely.

[deleted]

Re: Ask HN: Why is my web server being attacked?

#29

Post by slater »

runningmike wrote: post #4

Clear context is missing: what are you hosting, what webserver, who are you - person of interest?, what is your IP, hosted on a cloud service or too cheap vps? , what is your dns? And most important: what is behind your front door…

> what is your IP

NICE TRY, MR. HACKERMAN

Re: Ask HN: Why is my web server being attacked?

#30

Post by [deleted] »

gustavus wrote: post #10
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

Please don't do this, find another way. Almost 1/2 the internet is inaccessible to me at this point because at some point CF decided that I was a bad actor and now I can't get to anything.

[deleted]
Post reply on HN