2

My VPS is suffering from a (D)DoS doing a SYN flood with spoofed IPs. I'm right now searching from ways how to be able to defend (at least a bit) against it. It's running a DirectAdmin apache2 webserver. Mainly used for serving PHP and MySQL.

We are using CloudFlare, which are saying that they are able to mitigate (D)DoS at some level, now the attacker knows our real IP address, so CloudFlare isn't helping a bit.

I've done some searching on the net and found out about enabling SYN cookies, to defend against it. I've checked my settings and it seems it was enabled all along.

I've also read about that Varnish is able to defend against SYN flooding and Slowloris attacks, now I'm pretty interested in using that.

The thing is that CloudFlare is already caching a lot from us, and I don't wish to spend too much resources on Varnish. Is it possible and smart to set up Varnish only for the better handling of requests? Are there perhaps better ways which I've missed?

Thanks in advance, Martin

Martin Kanters
  • 21
  • 1

1 Answers1

-1

I'd request a new ip address (changing the ip address) from the VPS provider. That would be the simplest solution for solving this problem.

FINESEC
  • 1,371
  • 7
  • 8
  • I seem to have lost the access to my unregistered account... @FINESEC thanks for your reply, this is exactly what I'm doing right now, but I was wondering what – Martin Nov 06 '12 at 07:56