Defend Against DDoS Attack With (D)DoS Deflate

I have written an article about preventing DDoS attacks with mod_evasive in a previous post. But mod_evasive alone is not enough, because DDoS techniques may vary. DDoS (Distributed Denial of Service) basics: the attacker sends or floods the server with requests. This will make the server busy and if it overloads it will go down (service down). So basically it sends or floods requests to your server from one or more IPs.

You can check or count how many IP addresses are connected to your server with netstat. Here is the command to check IP addresses connected to your server:

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

It will show something like this:

      5 200.40.138.18
      5 80.72.93.190
      6 85.224.109.243
      7 151.71.229.240
      9 88.26.112.30
     12 93.196.4.253
     18 125.166.209.235
     28 212.117.8.117
     49 24.4.107.73
     52 205.134.249.144

So if you have more than 100 requests connected from a single IP address, that is unusual. You can block that IP with iptables. It’s not hard to do, but it will waste your time to check your netstat every day and ban some IP addresses. You can use (D)DoS Deflate to automate that.

(D)DoS Deflate is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. With (D)DoS Deflate you can configure how long an IP address will be blocked and how many connections are considered a DDoS.

How to install it:

1. Open your terminal and log in as root.

2. Download (D)DoS Deflate:

wget http://www.inetbase.com/scripts/ddos/install.sh

3. Give execute permission to the script:

chmod 0700 install.sh

4. Install it:

./install.sh

To add your IP address to the whitelist, edit this file:

vim /usr/local/ddos/ignore.ip.list

Configure (D)DoS Deflate:

vim /usr/local/ddos/ddos.conf

More details: visit the (D)DoS Deflate website.