[Need Help] How to stop ddos?

In The Name Of Allah
Al-Salam Alekum

hello, how to stop huge ddos?
Someone ddosed my friend forums, it was huge ddos, I heard that the ddoser paid a money for ddosing the forum.
You know anyway to stopping it?

Wa Salam Alekum

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough it will take down cloudflare witch would result in the users not reaching the site...

(01-17-2017, 09:29 PM)Pikami Wrote:

[To see links please register here]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (

  [To see links please register here]

  &

  [To see links please register here]

  )
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

(01-18-2017, 12:04 AM)Satan Wrote:

[To see links please register here]

(01-17-2017, 09:29 PM)Pikami Wrote:

[To see links please register here]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

(01-18-2017, 03:45 AM)Axi Wrote:

[To see links please register here]

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (

  [To see links please register here]

  &

  [To see links please register here]

  )
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

Yeah, he used Cloud Flare but the site shut down :sad: . the ddos was very strong.

(01-18-2017, 02:33 PM)Mr.Kurd Wrote:

[To see links please register here]

(01-18-2017, 12:04 AM)Satan Wrote:

[To see links please register here]

(01-17-2017, 09:29 PM)Pikami Wrote:

[To see links please register here]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

(01-18-2017, 03:45 AM)Axi Wrote:

[To see links please register here]

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (

  [To see links please register here]

  &

  [To see links please register here]

  )
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

Yeah, he used Cloud Flare but the site shut down :sad: . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

(01-18-2017, 03:24 PM)Axi Wrote:

[To see links please register here]

(01-18-2017, 02:33 PM)Mr.Kurd Wrote:

[To see links please register here]

(01-18-2017, 12:04 AM)Satan Wrote:

[To see links please register here]

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

(01-18-2017, 03:45 AM)Axi Wrote:

[To see links please register here]

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (

  [To see links please register here]

  &

  [To see links please register here]

  )
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

Yeah, he used Cloud Flare but the site shut down :sad: . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

Maybe I will ask them, but man you didn't hear the ddos attack for money, They start very huge ddos attack for 3 days just by I think 70$.

(01-18-2017, 03:46 PM)Mr.Kurd Wrote:

[To see links please register here]

(01-18-2017, 03:24 PM)Axi Wrote:

[To see links please register here]

(01-18-2017, 02:33 PM)Mr.Kurd Wrote:

[To see links please register here]

Yeah, he used Cloud Flare but the site shut down :sad: . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

Maybe I will ask them, but man you didn't hear the ddos attack for money, They start very huge ddos attack for 3 days just by I think 70$.

Yeah, there was probably a misconfiguration, as cloudflare (usually) wouldn't just "get up and leave".

Hey Mr. Kurd,
Sorry to hear of your troubles. Axi's advice on configuration is critical and this is square one for anybody running public-facing systems. You say that the attack was "very strong"; please elaborate. Origin, packet types, bandwidth consumed, duration etc. Logs would be ideal. Load balancers and firewalls are excellent but the fundamental problem with all DOS is link saturation.

PM me if you would like assistance configuring a more aggressive mitigation system.

Cheers,
Poly

Once a ddos is in place. You can't stop it. You can only take precautions.
I wouldn't trust cloudfare due to the fact that last time I checked. Wiresharking their backdoor is ez. So I prefer digitalfort but that's because someone I know runs it.

"He played a moneys to ddos it". There is no way to ddos for free unless you have your own personal method. Usually skids pay for booters.