I am looking for some information in regards DDoS in the follow scenario:  I have a server that is behind a Cisco Guard and it will be DDoS'ed, I only care about a set list of IPS that by not means are the attackers.  Is it possible to null all other ips but this list to actually get any response to my server or in the long run no matter what I do if they have enough DDoS power I will just go down like a flie ?  Is there any recommended company out there that can actually cope with a DDoS ?  My server will mainly run several clients that will get connected to a external server and all it needs access to is my local MySQL the the private network so I can access it.  There will be no other services runnings such as web or ftp etc at least not to the external ips of the server if i ever have to have any of these service they will be on the private network.  The MySQL will be available externally only to 1 safe ip not known by anyone but me and internally at localhost + private network.  Are there any solutions ?
2444
This is a  about DoS and DDoS mitigation.   I found a massive traffic spike on a website that I host today; I am getting thousands of connections a second and I see I'm using all 100Mbps of my available bandwidth.  Nobody can access my site because all the requests time out, and I can't even log into the server because SSH times out too!  This has happened a couple times before, and each time it's lasted a couple hours and gone away on its own.  Occasionally, my website has another distinct but related problem: my server's load average (which is usually around .25) rockets up to 20 or more and nobody can access my site just the same as the other case.  It also goes away after a few hours.  Restarting my server doesn't help; what can I do to make my site accessible again, and what is happening?  Relatedly, I found once that for a day or two, every time I started my service, it got a connection from a particular IP address and then crashed.  As soon as I started it up again, this happened again and it crashed again.  How is that similar, and what can I do about it?
56504
This is a  about DNS geo-redundancy.   It's extremely common knowledge that geo-redundant DNS servers located at separate physical locations are highly desirable when providing resilient web services. This is covered in-depth by document , but some of the most frequently mentioned reasons include:   Protection against datacenter disasters. Earthquakes happen. Fires happen in racks and take out nearby servers and network equipment. Multiple DNS servers won't do you much good if physical problems at the datacenter knock out both DNS servers at once, even if they're not in the same row. Protection against upstream peer problems. Multiple DNS servers won't prevent problems if a shared upstream network peer takes a dirt nap. Whether the upstream problem completely takes you offline, or simply isolates all of your DNS servers from a fraction of your userbase, the end result is that people can't access your domain even if the services themselves are located in a completely different datacenter.   That's all well and good, but are redundant DNS servers really necessary if I'm running all of my services off of the same IP address? I can't see how having a second DNS server would provide me any benefit if no one can get to anything provided by my domain anyway.  I understand that this is considered a best practice, but this really seems pointless!
38361
We have an SMTP only mail server behind a firewall which will have a public A record of mail..  The only way to access this mail server is from another server behind the same firewall.  We do not run our own private DNS server.  Is it a good idea to use the private IP address as an A record in a public DNS server - or is it best to keep these server records in each servers local hosts file?
19916
How do these anonymous VPNs work? They say you can browse the web using a different IP address than your own. How does this work?  I understand the Virtual Private Network model, I am just confused on how I browse the web with a different IP?
93678
I have a small but popular local website, it is a nonprofit venture. We arrange programming contest. But randomly in some contest our servers goes down. For example in last contest, we had around 300 users and we deployed 12 C4Large grade servers (when site went down, we increased server to tackle it) but still the site was down for 2 hours (even though after 1 hour most of the contestants left seeing the site not working). All our servers are accessed through AWS Load balancer and we use SSL in the load balancer level. I think due to using load balancer, IIS can't differentiate upcoming traffic by IP so i can't apply the IIS built in dynamic IP based restriction for such attack. Is there a way to do these from AWS?  Is this an issue of DDos/Dos attack on our server? We use the same server and same code but in some contest we face this issue but in some other we do not face this issue. But I do not know how to track this to be sure whether we are under DDos or not. What can we do to protect ourselves?  Thanks
95840
I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that any request to say, bad.com, would resolve to 127.0.0.1, thus not allowing anybody on my network to access that site.   I have set up Suricata to log all DNS requests, but how do I filter that down and narrow it and tell it to only log requests to 127.0.0.1 and let everything else go unlogged?   I tried to create a rule:  alert dns any any -&gt; 127.0.0.1 any (msg: "BLACKLISTED WEBSITE"; flow:to_client; content:"rrname";sid:2240001;rev:1;)   But that did not work.   What do I need to do to only log DNS requests to certain IPs? I cannot find any information in the documentation or anywhere else on the internet.   Thanks.
1927
I am new to AWS and I have a question. I want to host a website on two EC2 instances. From what I read, if I stop the EC2 instance the public IP will change. In my case, Route 53 should route traffic to load balancer.  How can I configure my load balancer to route the traffic to EC2 instances without changing the IP if I change one of them? In other words, is there a way to have a fixed public IP to my two EC2 instances when they are switched off such that my load balancer routes the traffic to them?  Thanks.
7625
You can reach this IP address  (if my computer is online). I want to assign a domain to it so I wonder how is that possible when I have no DNS? I do own my domain which is ".com". My IP is static.  Thanks
93232
I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip :  netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -nr   now i want add all ip addresses that made more than 200 requests into IPtables to DROP input and out put.
28092
I run a large bulletin board and I get spammers every now and again. My moderation team does a good job filtering them out but every time I IP ban them they seem to come back (I'm pretty sure it's the same person on some occasions, as the post patterns are exactly the same as are the usernames) but I'm afraid to ban them by IP address every time.  If they are on a dynamic IP address, I could be banning innocent users later down the line when they try to get to my forum through SERPs, but if I ban only via static IPs I know that I'm only banning that one person.  So, is there a way to properly determine if an IP address is static or dynamic?  Thanks.
116124
I've been trying to block ANY queries in my BIND server with no success.  I followed this post  which says that I can use minimal-responses but it doesn't work.  None of the answers fit my current configuration.  view world {     match-clients   { world-clients; };     allow-recursion { none; };     recursion       no;     allow-transfer  { key XXXXXX; };      minimal-responses yes;      forwarders      { };      include         "/etc/bind/world.conf"; };
104073
I have a Mikrotik RB2011 router, running RouterOS which connects to the internet via a static IP. In my lan I have two different servers, one that is on IP 192.168.89.11 and another on 192.168.89.12  My DNS (on cloudflare) resolves both myfirstserver.com and mysecondserver.com to my router's static IP.  Now, what I want to do is to somehow separate the traffic so all traffic for myfirstserver.com goes to 192.168.89.11 and traffic for mysecondserver.com goes to 192.168.89.12 (and both on port 80. I know I could just change ports but if these are servers publicly available, no user would set a different port than 80)  What I have tried so far, is to somehow mark the packets through mangle and then use that mark on NAT to do the proper dst-nat forward.  I try marking packets through either content or Layer 7 protocol regex (they work properly if the action is log. I can see them being logged correctly).  The thing is that after I mark them, it seems that NAT just ignores them and forwards the connection to the server that accepts the non-marked packets.  I think I have mixed up the order of filtering and the chains somehow.  Would someone be able to provide some pointers/assistance on how to accomplish this?  Thanks!  EDIT: My question is very specific, about marking packets in RouterOS on a Mikrotik router and checking the mark in NAT. it is not about whether i need a reverse proxy or whatever. Thanks  EDIT 2: @Cha0s asked my /ip firewall export so here it is:  /ip firewall layer7-protocol add name=haf1a regexp=haf1a  /ip firewall address-list add address=192.168.89.0/24 list=local add address=192.168.88.0/24 list=local add address=www.xxx.yyy.zzz list=local add address=192.168.87.0/24 list=local  /ip firewall filter add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=virus comment="Drop 80 DoS attack" src-address-list=spammer add action=add-src-to-address-list address-list=spammer address-list-timeout=1d chain=input connection-limit=10,32 dst-address-list=!local dst-port=53 protocol=udp add action=drop chain=input dst-port=53 protocol=udp src-address-list=!local add action=add-src-to-address-list address-list=spammer address-list-timeout=1d chain=input connection-limit=30,32 protocol=tcp /ip firewall mangle add action=change-mss chain=forward new-mss=1422 out-interface=all-ppp protocol=tcp tcp-flags=syn tcp-mss=1423-65535  /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway add action=masquerade chain=srcnat out-interface=pppoe-out1 add action=dst-nat chain=dstnat comment="No HAF mark" dst-address=www.xxx.yyy.zzz dst-port=80 packet-mark=!haf1 port="" protocol=tcp src-port="" to-addresses=192.168.89.41 to-ports=80 add action=dst-nat chain=dstnat comment="HAF mark" dst-address=www.xxx.yyy.zzz dst-port=80 packet-mark=haf1 port="" protocol=tcp src-port="" to-addresses=192.168.89.31 to-ports=80   where www.xxx.yyy.zzz is my external ip (static) and 192.168.89.31 and 192.168.89.41 my two servers inside my local network  My goal is to redirect any connections with haf1a in them (eg haf1a.lala.com) to the relevant server (192.168.89.31)
48848
So I've set public IP on the hosts file for a certain public IP address, but it picks up private ip from nowhere or from DNS.       Content of windows hosts file C:\Windows\System32\drivers\etc\Hosts             210.210.210.10 my.domain.com     nslookup my.domain.com             10.10.10.10             10.10.10.11             10.10.10.12   I want it to resolve to Public IP i assigned in the file, instead of the private IP it shows when I lookup my.publicdomain.com.   Anyway to fix this? Has anyone experienced such issue? ipconfig /flushdns does not help. Just saying.
34186
With OpenDNS now needing one to be on the pro package to have filtering turned on, being on a tight budget, we are in need of free DNS filtering.  After reading , I collected SquidGuard blacklists and concatenated domains in the categories i needed into one big list. I then fed it to  generating a file containing about 2 million zones.  named-checkconf parses it just fine, but reloading named takes almost 10 minutes, then it wont resolve anything, and the server slows down to a crawl. Removing the include results in named working properly again.  Whats the proper way to set up BIND9 to work as a DNS firewall efficiently? If it's possible to also block any domain that resolves to specific IP addresses that would solve the whole problem.   I'm running bind as non-authoritative, just a caching server.
73488
I have a random domain name which has it's A record going to my dedicated IP. Therefore duplicating content. Is there a way I can disable the domain at IP level maybe in iptables?  I have a .htaccess setup to redirect to the main domain as its always force HTTPS.
43060
I have a problem in which I cannot access a server using its public name from the same network as the server. Access to the server works fine from the internet.  Reading up on this problem, I've ran across such things as hairpin NAT, loopback NAT, split DNS, editing hosts files, etc.  My network has a SMC 8013WG-CCR (Comcast) cable modem connected to a Linksys WRT54G2. As I understand, the router is supposed to handle this sort of loopback (by leaving the security option "Filter Internet NAT Redirection" disabled), but the connection between these two devices is a secondary LAN, so I don't think the router "knows" what the proper public IP address is.  The easiest solution would be to edit the hosts files of all the computers in the network, but many are notebook computers which will need to access the server both on the LAN and externally.  The server is Windows Server 2012, so I could set it up as the internal DNS server but I don't have enough experience with this to really understand how it would interact with the router, DHCP, etc.  I am prepared to purchase a new router if I need something with greater capability. It appears from my research that most IT admins prefer to solve this problem with split DNS rather than hairpin NAT. I understand the concept of hairpin NAT more clearly than split DNS. It seems to me that the router just needs to provide LAN clients with the local IP of the server when clients use the public name (sub.domain.com). Isn't that just an entry in a local DNS cache? Is that what split DNS does?  What would be a good solution to implement this fix for a small business?
90540
The MSP for a law firm office that has just joined our company is using a FQDN as an internal AD Domain and has been doing so for sometime apparently. They have this issue in that they have a website of the same FQDN which is hosted offsite, so when they try to browse  they get the IIS7 page of their DC rather than the website which we (outside of their local network) see.   works fine internally because they have a forward lookup on their DC, but I've asked them to do the same for the hostless A record of the website and the MSP said that would need to be researched first and might have to be dealt with as a project because of the implications on the local domain and RDS environment. Is this the case? Isn't all AD domain lookups done via UNC and IP rather than DNS lookups?