4 ms·
Here is a sweet trick for dropping traffic with NGINX. When I mean drop, I mean, don't send a response, literally terminate the connection. location = / {
by nodesocket 11y ago
Here is a sweet trick for dropping traffic with NGINX. When I mean drop, I mean, don't send a response, literally terminate the connection.
location = / {
if ($http_user_agent ~* foo|bar) {
# return non-standard (NGINX only) 444 code
# closes the connection without sending a response header
return 444;
}
}
- NetStrikeForce 11y agoIf I'm not mistaken, the above implies accepting a TCP connection (3-way handshake) and a request from the attacker; then you look up the contents of the user-agent header and decide to stop replying based on its contents. This will get you nothing in a typical DDoS scenario, but thanks for sharing as it may come handy for other situations.
- creshal 11y agoFiltering like that also has a rather big performance impact on the nginx side and make things worse under moderate, but not DDoS-y, traffic conditions.
- kabdib 11y agoI'd love to be able to "drop" a connection without sending a FIN to the attacker. Leave them hanging on a timeout.