Application-Layer DDoS Attack Protection with HAProxy

blog20181109-01.cfg

backend per_ip_rates
 stick-table type ip size 1m expire 10m store http_req_rate(10s)

blog20181109-02.cfg

frontend fe_mywebsite
    bind *:80
    http-request track-sc0 src table per_ip_rates

blog20181109-03.cfg

frontend fe_mywebsite
    bind *:80
    http-request track-sc0 src table per_ip_rates
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }

blog20181109-04.sh

Feb 8 17:15:07 localhost hapee-lb[19738]: 192.168.1.2:49528 [08/Feb/2018:17:15:07.182] fe_main fe_main/<NOSRV> 0/-1/-1/-1/0 429 188 - - PR-- 0/0/0/0/0 0/0 "GET / HTTP/1.1"

blog20181109-05.cfg

http-request track-sc0 src table per_ip_rates if METH_POST
http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }

blog20181109-06.cfg

timeout tarpit 5s
http-request tarpit if { sc_http_req_rate(0) gt 100 }

blog20181109-07.cfg

timeout http-request 5s
option http-buffer-request

blog20181109-08.cfg

http-request deny if HTTP_1.0

blog20181109-09.cfg

http-request deny if { req.hdr(user-agent) -i -m sub curl }

blog20181109-10.cfg

http-request deny if { req.hdr(user-agent) -i -m sub curl phantomjs slimerjs }

blog20181109-11.cfg

http-request deny if { req.hdr(user-agent) -i -m sub -f /etc/hapee-1.8/badagents.acl }

blog20181109-12.cfg

http-request deny unless { req.hdr(user-agent) -m found }

blog20181109-13.cfg

http-request deny if { src -f /etc/hapee-1.8/blacklist.acl }

blog20181109-14.map

1.0.1.0/24
1.0.2.0/23
1.0.8.0/21
1.0.32.0/19
1.1.0.0/24
1.1.2.0/23
1.1.4.0/22
# etc.

blog20181109-15.cfg

http-request deny if { src -f /etc/hapee-1.8/greylist.acl } { sc_http_req_rate(0) gt 5 }

blog20181109-16.cfg

dynamic-update
    update id /etc/hapee-1.8/blacklist.acl url https://192.168.122.1/blacklist.acl delay 60s

blog20181109-17.cfg

frontend per_ip_connections
    stick-table type ip size 1m expire 1m store conn_cur,conn_rate(1m)

blog20181109-18.cfg

frontend fe_smtp
    mode tcp
    bind :25
    option tcplog
    timeout client 1m
    tcp-request content track-sc0 src table per_ip_connections
    tcp-request content reject if { sc_conn_cur(0) gt 1 } || { sc_conn_rate(0) gt 5 }
    default_backend be_smtp

blog20181109-19.cfg

backend be_smtp
    mode tcp
    timeout server 1m
    option tcp-check #For SMTP specifically smtpchk can be used
    server smtp1 162.216.18.221:25 maxconn 50 check

blog20181109-20.cfg

tcp-request inspect-delay 10s
tcp-request content accept if { sc_conn_rate(0) lt 2 }
tcp-request content reject if { req_len gt 0 }

blog20181109-21.cfg

use_backend be_website_bots if { sc_http_req_rate(0) gt 100 }

blog20181109-22.cfg

http-request silent-drop if { sc_http_req_rate(0) gt 100 }