DDOS attack protection HAPROXY SSL

Question

I'm trying to protect my server from DDOS attacks, my server always have a redirection to the SSL/HTTPS protocol.

but I'm using the next configuration and it's not working

frontend http-in
    bind *:80

    stick-table type ip size 1m expire 5m store gpc0
    tcp-request connection track-sc0 src
    tcp-request connection reject if { sc0_get_gpc0 gt 0 }
    tcp-request connection reject if { src_conn_rate(Abuse) ge 10 }
    tcp-request connection reject if { src_conn_cur(Abuse) ge 10 }
    tcp-request connection track-sc1 src table Abuse

    redirect scheme https if !{ ssl_fc }
    reqadd X-Forwarded-Proto:\ http
    default_backend code


frontend https-in
    bind *:443 ssl crt [SOME CERT]
    reqadd X-Forwarded-Proto:\ https
    default_backend code

    stick-table type ip size 1m expire 5m store gpc0
    tcp-request connection track-sc0 src
    tcp-request connection reject if { sc0_get_gpc0 gt 0 }
    tcp-request connection reject if { src_conn_rate(Abuse) ge 10 }
    tcp-request connection reject if { src_conn_cur(Abuse) ge 10 }
    tcp-request connection track-sc1 src table Abuse

backend code
    stick-table type ip size 1m expire 5m store http_req_rate(10s)
    acl click_too_fast sc1_http_req_rate gt 10
    acl mark_as_abuser sc0_inc_gpc0(http) gt 0
    tcp-request content track-sc1 src
    tcp-request content reject if click_too_fast mark_as_abuser

    balance roundrobin
    option httpclose
    option forwardfor
    cookie JSESSIONID prefix
    server node3 [SOMEIP] check
    server node4 [SOMEIP] check

I'm testing my configuration with the command

ab -n 11 -c 1 [DOMAIN]

but the server never blocks my connection, what i'm doing wrong?

I've got the configuration from here:

https://www.haproxy.com/blog/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/

Your config doesn't look at all as in the blog. – Gerard H. Pille Aug 02 '18 at 19:49 — Gerard H. Pille, Aug 02 '18 at 19:49

score 1 · Accepted Answer · answered Aug 02 '18 at 19:54

1

Eg.

tcp-request connection reject if { src_conn_rate(Abuse) ge 10 }
acl mark_as_abuser sc0_inc_gpc0(http) gt 0

You don't have tables Abuse nor http. The name of the table is the name of the back- or frontend in which it is defined. You have tables http-in and https-in, eg.

answered Aug 02 '18 at 19:54

Gerard H. Pille

2,569
1
13
11

Yup, and you are only storing ONE variable in the stick-table and then trying to access more than one? I used Willys blog and tried to make it simpler here: https://www.loadbalancer.org/blog/simple-denial-of-service-dos-attack-mitigation-using-haproxy-2/ I probably failed though :-). – Malcolm turnbull Aug 03 '18 at 06:56

DDOS attack protection HAPROXY SSL

1 Answers1