Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why is my web server being attacked?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Ask HN: Why is my web server being attacked?

#31

Post by ozim »

cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

Pro Tip - if you can get cheap IPv6 host cloudflare proxy will work for you as well for IPv4 as they will handle it.

You setup only AAAA record and you are reachable from IPv4 as well as much as other cloudflare caching benefits that you get.

Re: Ask HN: Why is my web server being attacked?

#32

Post by KTibow »

piperswe wrote: post #18
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

If you set up Cloudflare Tunnel, you don't even need to be set up to accept any incoming connections. With Access, you can even run SSH through that tunnel. You can then setup your firewall to drop any incoming packets for non-established connections, closing a significant hole for DoS attacks and such.

I mean for the author's case you could go all the way and use CF Pages

Re: Ask HN: Why is my web server being attacked?

#33

Post by brailsafe »

Do you have a Taiwanese language endpoint? It's fair to assume that anything on the web is going to be attacked at some point, but in my experience it was traffic coming from some unknown country that must have had beef with Taiwan (China obvs) because as soon as I blocked traffic to that endpoint the problem went away. It was enabled by default, but we weren't doing anything special in terms of localization, so it was a reasonable action to take.

Re: Ask HN: Why is my web server being attacked?

#34

Post by throwaway67743 »

Erratic6576 wrote: post #20
gustavus wrote: post #10

Earlier quoted context omitted.

Please don't do this, find another way. Almost 1/2 the internet is inaccessible to me at this point because at some point CF decided that I was a bad actor and now I can't get to anything.

Have you tried changing the web browser or VPN?

Enabled cookies? Checked your TCP/IP settings?

Re: Ask HN: Why is my web server being attacked?

#39

Post by kkielhofner »

codegeek wrote: post #15
cameron_b wrote: post #9

Adding to what has already been said- New registrations are the food for probing. You could have an IP on someone's naughty list from a previous user. It's any other day on the internet. That's just what the neighborhood ( the whole internet ) looks like from the sidewalk. So, Set up a free Cloudflare account, move your DNS of record to them, and run traffic through Cloudflare to your server.

Cloudflare won't protect your IP being hit directly. If your IP can be accessed publicly, it will get hit. period. You could use nginx etc to do a 444 status code but can't stop these scripts/bots from hitting ur IP completely.

Cloudflare tunnels:

https://www.cloudflare.com/products/tunnel/

I haven’t had anything exposed to the Internet in a long while.

Post reply on HN