Persistent DDoS Problems

[Nevada]

Hello,
I'm currently running a hotel reaching at peak 400 users online on a powerful dedicated server however I keep getting hit with attacks reaching 100mbps+. This is extremely frustrating. I have added cloudflare to my site which would work however there is still one way my server IP can be obtained, by viewing source on the client. When you view the source it shows "connection.info.host" : "my_server_ip". Is there any way to remove this or somehow make it so my IP doesn't show? Would appreciate any help, thanks.

 

[Alam]

You can always change that IP for one given IP of cloudflare , However they should probably already have your IP , what you should do is Download Dynamic IP , Then check your logs and find the attacking IP or just get PeerBlock , and Ban that ip from your IIS , then the packets won't proceed to your webserve.

 

[Thom]

You can define it in the variables I think but even still, its easy to find out

 

[Alam]

Yea , most likely They can do a Ftp nslookup on your server , and get your actual ip , but if you have a good restriction on your webserve , they shouldn't be able to hit you.

 

[Nevada]

I didn't think the cloudflare IP could be used for "connection.info.host" : "SERVER IP",? Can it be?

 

[Kryptos]

You can define it in the variables I think but even still, its easy to find out

That'd do no difference, would be the same results.

 

[Alam]

I didn't think the cloudflare IP could be used for "connection.info.host" : "SERVER IP",? Can it be?

It can if you add some sort of access on your URL rewrite and application pool.

 

[Nevada]

It can if you add some sort of access on your URL rewrite and application pool.

Any chance you could provide a little info on how i'd do this? Would appreciate it a lot thanks

 

[Thom]

That'd do no difference, would be the same results.

Yeah but if you define it in the variables, you can change
connection.info.host
to something like
connection.something.host

so it looks fake :3

 

[Livar]

Go into external_variables;

In somewhere, not really see-able add this code;

connection.info.host" : "server_ip"

In the client, remove the connection.info.host, and add;

[/COLOR][/FONT][/SIZE][SIZE=4][FONT=monospace][COLOR=#000000]"connéction.information.host" : "random.ip"[/COLOR][/FONT][/SIZE][SIZE=4][FONT=monospace][COLOR=#000000]

Try this, report back.[/CODE][/COLOR][/FONT][/SIZE]

 

[Nevada]

Does anyone know how the larger hotels deal with this? They must have means of preventing DDoS attacks somewhat

 

[Livar]

They use the 'firewall'?

 

[Nevada]

They use the 'firewall'?

Which firewall is this? Windows firewall?

 

[Livar]

Indeed, if your using IIS, enable firewall, allow exceptions for, ports:

80, 3306, server ports, ect.

 

[Nevada]

How do I block to connections to all ports except a certain few? Do I add a block to all TCP ports in inbound and outbound rules then make new rules in each for allowing the ones I need?

Cheers

 

[Zak]

Big hotels use IIS.

IIS has a plugin for Anti-DOS

Big hotels also use Phoenix.

Which like rSockets, it has anti-ddos for the socket and mus ip.

 

[Nevada]

I'm currently using IIS. What is the plugin called?

Thanks

 

[Spartak]

if you know...

but the easy way to get an ip ==> Start ==> Run ==> CMD ==> config

You must be registered for see links

 

[brsy]

I'm currently using IIS. What is the plugin called?

Thanks

Bro c'mon... Just put s0me work into it and use google! sheesh.