English 中文(简体)
减缓吉大港山区对AWS的洪水袭击:Nginx组合诉AWS盾高级和网络应用防火墙
原标题:Mitigating HTTP flood attacks on AWS: Nginx configuration vs. AWS Shield Advanced and Web Application Firewall

I m currently researching the best options for mitigating and avoiding HTTP flood attacks while hosting infrastructure on AWS.

这里发表于乌云盖雷的文章。

https://blog.cloudflare.com/cloudflare-mitigates-record-breaking-71-million-request-per-second-ddos-attack/

根据我的理解,AWS盾标准可能不包括吉大港山区在网状上的洪水袭击。 利用AWS盾牌先进技术,是启动成本的可行选择,因为它每年花费36 000美元,需要一年的承诺。 采用防火墙和执行率限制机制是各种选择,但即使在通过AWS网络应用防火墙阻止IP地址时,甚至在被封锁的IP公司提出请求时,仍按要求收取费用。

有人建议,在网络一级使用Nginx,可以有效地将已知的恶意知识产权限制在每分钟零一次的要求上。 这里是原状的样本配置。 专栏:

    # Define a rate limiting zone for the IP address.
    limit_req_zone $binary_remote_addr zone=blocked:1m rate=1r/m;

    server {
        listen 80;
        server_name yourdomain.com;

        # Rate limit requests from the specified IP address.
        location / {
            limit_req zone=blocked burst=1 nodelay;
            # Add other Nginx configuration directives here.
        }

        # Block requests from the specific IP address.
        location /block-ip {
            deny all;
            return 403;
        }

        # Add other server configuration here.
    }
}

Could someone please confirm if this would indeed keep my bill down to zero dollars beyond the normal monthly cost of the EC2 instance, in case of an HTTP flood attack?

我正在审理一个EC2级案例,有一个固定的IP地址,使用快车(快车)进行Node.js的申请。 这一应用是一种反向的代理,并按要求与一个无服务器的数据库进行交流。 也许值得注意的是,快递是人工配置的,以便在443港的HTTPS上运行。

此外,我有兴趣了解这种做法的权衡,而不是使用AWS网络应用防火墙。 具体来说,我很想知道,在使用Nginx办法时,服务器的性能将如何受到攻击。 相对性或其他业绩的退化是否增加? 我正试图抹去身份不明的人! 在我失踪的情况下是否有更好的选择?

任何建议或见解都受到高度赞赏! 提前感谢您。

问题回答

你在“盾牌”中的反应不属所有美国世界协会客户的预算范围,但是,经营一个因特网暴露的单一案例并不是德国电信公司。 欲获得适当的7层保护,请与世界妇女论坛网络联系。 如果你的内容是切合需要的,那么通过VPC-endpoint从S3中提取。

Without ALB (or CF) with WAF, Shield Standard layer 3/4 mitigations will eventually kick in which may finish the job the attackers started. ALB/CF scale to meet demand. Your AWS WAF WebACL should have (at a minimum):

  • one or more rate-based rules in Block mode
  • the AWSManagedIPReputation rulegroup - preferably with IPDDoSList rule moved to Block mode or else rate-based with a subsequent rule that uses the IPDDosList label as an aggregation key.

ALB本身提供了保护,并且也有标准保护,但注意到这涉及13和14次攻击。 对7层来说,你需要大耳。





相关问题
Mount windows shared drive to MWAA in bootscript

In MWAA startup script sudo yum install samba-client cifs-utils -y sudo mount.cifs //dev/test/drop /mnt/dev/test-o username=testuser,password= pwd ,domain=XX Executing above commonds giving error - ...

How to get Amazon Seller Central orders programmatically?

We have been manually been keying Amazon orders into our system and would like to automate it. However, I can t seem to figure out how to go about it. Their documentation is barely there. There is: ...

Using a CDN like Amazon S3 to control access to media

I want to use Amazon S3/CloudFront to store flash files. These files must be private as they will be accessed by members. This will be done by storing each file with a link to Amazon using a mysql ...

unable to connect to database on AWS

actually I have my website build with Joomla hosted on hostmonster but all Joomla website need a database support to run this database is on AWS configuration files need to be updated for that I ...

Using EC2 Load Balancing with Existing Wordpress Blog

I currently have a virtual dedicated server through Media Temple that I use to run several high traffic Wordpress blogs. Both tend to receive sudden StumbleUpon traffic surges that (I m assuming) ...

SSL slowness in EC2

We ve deployed our rails app to EC2. In our setup, we have two proxies on small instances behind round-robin DNS. These run nginx load balancers for a dynamically growing and shrinking farm of web ...

热门标签