In practice, haproxy is used to defend against ddos and haproxyddos.

In practice, haproxy is used to defend against ddos and haproxyddos.

First, implement a door defense in http.

Frontend http

Bind 10.0.0.20: 80

Acl anti_ddos always_true

# Whitelist

Acl whiteip src-f/usr/local/haproxy/etc/whiteip. lst

# Marking illegal users

Stick-table type ip size 20 k expire 2 m store gpc0

Tcp-request connection track-sc1 src

TCP/IP request inspect-delay 5S

# Reject illegal user connection Establishment

Tcp-request connection reject if anti_ddos {src_get_gpc0 gt 0}

Then create a defense portal in the specific website module.

 

Backend xxx.xxx.cn

Mode http

Option forwardfor

Option httplog

Balance roundrobin

Cookie SERVERID insert indirect

Option httpchk GET/KeepAlive. ashx HTTP/1.1 \ r \ nHost: \ server.1card1.cn

Acl anti_ddos always_false

# Whitelist

Acl whiteip src-f/usr/local/haproxy/etc/whiteip. lst

# Store the clients' session rate within 10 seconds

Stick-table type ip size 20 k expire 2 m store http_req_rate (10 s), bytes_out_rate (10 s)

Tcp-request content track-sc2 src

# Suspicious if the session rate exceeds 50 in 10 seconds

Acl conn_rate_limit src_http_req_rate (server.1card1.cn) gt 80

# Determine whether a SERVERID cookie exists in an http request

Acl cookie_present cook (SERVERID)-m found

# Mark as an invalid user

Acl mark_as_abuser sc1_inc_gpc0 gt 0

Tcp-request content reject if anti_ddos! Whiteip conn_rate_limit mark_as_abuser