DDoS Protection & Security

1. Angriber inficerer tusindvis af enheder (botnet)
2. Koordineret angreb startes fra alle inficerede enheder
3. Målserveren overbelastes med requests
4. Legitime brugere kan ikke få adgang til servicen
5. Servicen bliver utilgængelig (denial of service)

# Normal TCP Handshake:
Client -> Server: SYN
Server -> Client: SYN-ACK
Client -> Server: ACK (Connection established)

# SYN Flood Attack:
Attacker -> Server: SYN (fake source IP)
Server -> Fake IP: SYN-ACK (never reaches destination)
Server waits for ACK... (connection table fills up)

# Kontroller netværkstrafik
netstat -i

# Se aktive forbindelser
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

# Overvåg båndbreddeforbrug
iftop -i eth0

# Se systembelastning
htop

# Kontroller log filer
tail -f /var/log/nginx/access.log | grep "POST\|GET"

# Begræns SYN flood angreb
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

# Begræns ICMP ping
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

# Bloker common attack patterns
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

[http-get-dos]
enabled = true
port = http,https
filter = http-get-dos
logpath = /var/log/nginx/access.log
maxretry = 300
findtime = 300
bantime = 600
action = iptables[name=HTTP, port=http, protocol=tcp]

# Rate limiting
http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    limit_conn_zone $binary_remote_addr zone=addr:10m;
}

server {
    # Anvend rate limiting
    limit_req zone=one burst=5;
    limit_conn addr 10;
    
    # Timeout indstillinger
    client_body_timeout 5s;
    client_header_timeout 5s;
    
    # Buffer begrænsninger
    client_body_buffer_size 200K;
    client_header_buffer_size 2k;
    large_client_header_buffers 3 1k;
}

global
    daemon
    maxconn 4096

defaults
    mode http
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

frontend web_frontend
    bind *:80
    bind *:443 ssl crt /path/to/certificate.pem
    redirect scheme https if !{ ssl_fc }
    default_backend web_servers

backend web_servers
    balance roundrobin
    option httpchk GET /health
    server web1 192.168.1.10:80 check
    server web2 192.168.1.11:80 check
    server web3 192.168.1.12:80 check

# Redis konfiguration for caching
# /etc/redis/redis.conf

maxmemory 2gb
maxmemory-policy allkeys-lru
save 900 1
save 300 10
save 60 10000

# Nginx caching
location / {
    proxy_cache_valid 200 302 10m;
    proxy_cache_valid 404 1m;
    proxy_cache my_cache;
    proxy_pass http://backend;
}

http {
    geoip_country /usr/share/GeoIP/GeoIP.dat;
    
    map $geoip_country_code $allowed_country {
        default yes;
        CN no;
        RU no;
        KP no;
    }
}

server {
    if ($allowed_country = no) {
        return 403;
    }
}

# Page Rules for DDoS protection
Cache Level: Cache Everything
Browser Cache TTL: 1 month
Security Level: High
Challenge Passage: 30 minutes

# Firewall Rules
(ip.geoip.country in {"CN" "RU" "KP"}) - Block
(cf.threat_score gt 10) - Challenge
(http.request.uri.path contains "/admin") - Challenge

# Anycast routing fordeler:
1. Geografisk distribueret - angreb påvirker kun nærmeste pop
2. Massive båndbreddekapacitet
3. Automatisk failover
4. Caching reducerer backend belastning
5. DDoS absorptionskapacitet

# HTTP request rate
rate(nginx_http_requests_total[5m])

# Connection count
nginx_connections_active

# Error rate
rate(nginx_http_requests_total{status=~"4xx|5xx"}[5m])

# Bandwidth usage
rate(node_network_receive_bytes_total[5m]) * 8

# High traffic alert
- alert: HighTrafficRate
  expr: rate(nginx_http_requests_total[5m]) > 1000
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: "High traffic detected"
    description: "{{ $value }} requests per second"

# DDoS Attack Detection
- alert: PossibleDDoS
  expr: rate(nginx_http_requests_total[1m]) > 5000
  for: 30s
  labels:
    severity: critical
  annotations:
    summary: "Possible DDoS attack detected"

# Logstash configuration for nginx logs
filter {
  grok {
    match => { 
      "message" => "%{NGINXACCESS}" 
    }
  }
  
  if [response] >= 400 {
    mutate {
      add_tag => [ "error" ]
    }
  }
  
  # Detect potential DDoS patterns
  if [request] =~ /\/wp-admin|\/admin|\.php$/ {
    mutate {
      add_tag => [ "suspicious" ]
    }
  }
}

#!/bin/bash
# DDoS Emergency Response Script

# Check current connections
CONNECTIONS=$(netstat -ntu | wc -l)
THRESHOLD=1000

if [ $CONNECTIONS -gt $THRESHOLD ]; then
    echo "DDoS Attack Detected - $CONNECTIONS connections"
    
    # Block top attacking IPs
    netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -10 | while read count ip; do
        if [ $count -gt 50 ]; then
            iptables -A INPUT -s $ip -j DROP
            echo "Blocked IP: $ip ($count connections)"
        fi
    done
    
    # Enable SYN cookies
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    
    # Reduce timeout values
    echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
    echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
    
    # Send alert
    curl -X POST "https://hooks.slack.com/webhook" \
         -d '{"text":"DDoS attack detected on '$(hostname)'"}'
fi