Skip to content

mrwalruss/xnohatddosfirewall

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 

Repository files navigation


XNOHAT DDoS FIREWALL

Version: 1.1

[email protected]

INSTRUCTION

Notes:

For CentOS only, modify yourself for other distros

/!\ Must do: Stop all Web/HTTPD Services and Database Services for free resources first

[!] Recommend:

  • Using this firewall script on your reverse proxy
  • Block all traffic to your main (upstream) server except traffic from Reverse Proxy
  • Implement DNS Round robin with multiple reverse proxies to reduce DDoS load first
  • Contact ISP to upgrade your server BANDWIDTH, RAM, CPU, HDD to maximum of your budget first. I suggest: 4-8 Cores CPU, 16-32 GB RAM, 50 GB SSD, Port 1Gbps NIC Bandwidth

Step-by-step

$ yum install epel-release

$ yum install nload tmux

$ yum install php php-pdo

[+] Setting $logfile variable in logparser.php to path to your access.log

[+] Modify logparser.php to match your access log format ( we need parse "ip of request" and "time of request" ), especially time of request must change to match SQLite time format look like 2016-11-05 01:35:24 Example log line from nginx: 180.93.103.169 - - [05/Nov/2016:03:19:12 +0700] "GET / HTTP/1.0" 200 148608 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US)" "-"

[+] Modify analyser.php, setting $threshold as number of request per $timewindow , any ip over this threshold will be block by iptables

To get right Threshold for DDoS attacking you, do step below

  • Use tcpdump to get packets attacking you $ tcpdump -vvvv -i <your_interface> -w <file_name.pcap>
  • Open .pcap file in Wireshark:
    • go to Edit -> Preference set:
      • "Show burst count for item rather than rate" set Enabled (check mark in the box)
      • set Burst rate resolution = Burst rate window size = 60000 miliseconds (1 min)
  • Go Statistic -> ipv4 -> all addresses: burst rate is number of packets per minute, use average numbers (just guess!) to Threshold

$ chmod +x ./xnohatddosfirewall/runddosfirewall.sh

$ chmod 777 ./xnohatddosfirewall

Run script with sudo or root privilege: sudo ./runddosfirewall.sh follow guide on screen

Press "Ctrl-b d" : to detach tmux

Re-attach tmux by command $ tmux attach -t 0

Start all your services again

About

xnohat DDoS Firewall based on iptables

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages

  • PHP 86.6%
  • Shell 13.4%