[Mr.Kurd]

In The Name Of Allah
Al-Salam Alekum

hello, how to stop huge ddos?
Someone ddosed my friend forums, it was huge ddos, I heard that the ddoser paid a money for ddosing the forum.
You know anyway to stopping it?

Wa Salam Alekum

[Pikami]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough it will take down cloudflare witch would result in the users not reaching the site...

[Satan]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

[Wildfire]

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

[Mr.Kurd]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

Yeah, he used Cloud Flare but the site shut down . the ddos was very strong.

[Wildfire]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

Yeah, he used Cloud Flare but the site shut down . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

[Mr.Kurd]

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.

Without much details being given, here's what I would do:

• Configure CloudFlare on the domain
  
• Change the IP address of the primary server
  
• Get 2-3 low cost SSD based VPSes with 1gbps bandwidth
  
• Set the DNS up in a way that the A records round robin around those VPSes
  
• Configure a caching nginx proxy that reverse proxies to the main server
  
• On the main server: iptables ports 80 & 443 to only allow connections from the caching proxies
  
• On the VPSes being used as proxies: iptables ports 80 & 443 to only allow connections from CloudFlare origin nodes (https://www.cloudflare.com/ips-v4 & https://www.cloudflare.com/ips-v6)
  
• Use CloudFlare page rules to block countries commonly known for abuse, and additionally instruct CloudFlare edge nodes to cache static resources
  
• Modify the forum/CMS software to remove any external and remote calls to unauthorized servers, e.g. avatar URL or pingback
  

Yeah, he used Cloud Flare but the site shut down . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

Maybe I will ask them, but man you didn't hear the ddos attack for money, They start very huge ddos attack for 3 days just by I think 70$.

[Blink]

Yeah, he used Cloud Flare but the site shut down . the ddos was very strong.

Chances are, 99.9%, the admin did not patch fetch_remote_file and the attacker simply bypassed CloudFlare.

Maybe I will ask them, but man you didn't hear the ddos attack for money, They start very huge ddos attack for 3 days just by I think 70$.

Yeah, there was probably a misconfiguration, as cloudflare (usually) wouldn't just "get up and leave".

[CRNpolyfluoric]

Hey Mr. Kurd,
Sorry to hear of your troubles. Axi's advice on configuration is critical and this is square one for anybody running public-facing systems. You say that the attack was "very strong"; please elaborate. Origin, packet types, bandwidth consumed, duration etc. Logs would be ideal. Load balancers and firewalls are excellent but the fundamental problem with all DOS is link saturation.

PM me if you would like assistance configuring a more aggressive mitigation system.

Cheers,
Poly

[zenith]

Once a ddos is in place. You can't stop it. You can only take precautions.
I wouldn't trust cloudfare due to the fact that last time I checked. Wiresharking their backdoor is ez. So I prefer digitalfort but that's because someone I know runs it.

"He played a moneys to ddos it". There is no way to ddos for free unless you have your own personal method. Usually skids pay for booters.