HaProxy + CloudFlare

Question

我试图设置HaProxy与DDoS保护规则(速率限制)。然而，我认为HaProxy现在正在限制CloudFlare is，而不是访问者/真实is。(注意:我的站点本身很好，因为我已经在我的站点的PHP代码中修复了这个问题)，我如何解决这个问题呢？

我的/etc/haproxy/haproxy.cfg

global
      log 127.0.0.1 local0 notice
      maxconn 10000
      user haproxy
      group haproxy
defaults
      log global
      mode http
      option httplog
      option dontlognull
      retries 3
      option redispatch
      timeout http-request 10s
      timeout connect 5000
      timeout client 30s
      timesout server 5000

frontend domain
      bind *:80
      stick-table type ip size 1m expire 10s store gpc0,http_req_rate(10s)
      tcp-request connection track-sc1 src
      tcp-request connection reject if { src_get_gpc0 gt 0 }
      default_backend nginx

backend nginx
      mode http
      stats enable
      stats uri /HIDDEN
      stats realm Strictly\ Private
      stats auth USER:PASSWORD
      balance roundrobin
      option httpclose
      option httpchk HEAD / HTTP/1.1\r\nHost:domainhidden.eu
      acl abuse src_http_req_rate(domain) ge 100
      acl flag_abuser src_inc_gpc0(domain)
      tcp-request content reject if abuse flag_abuser
      server web1 iphere1:80 check
      server web2 iphere2:80 check
      server web3 iphere3:80 check

我更改了配置中的域、用户和密码，因为否则人们可以进入我的网站统计数据:P (domainhidden.eu，USER:PASSWORD和“iphere”)

Answer 1

Cloudflare 看跌期权原始IP地址在CF-Connecting-IP HTTP报头中。因此，为了区分通过CF服务器的攻击者和经过同一服务器的其他人，可以使用这个标头值作为密钥。

这里的配置，帮助我对抗一个野蛮人强迫我的网站网址。

frontend www-https
    # ...
    # front-end config details skipped
    # ...

    default_backend www-backend

    # Use General Purpose Couter 0 in SC0 as a global abuse counter
    stick-table type string len 40 size 1m expire 300s store gpc0

    # wait for at most 5 seconds for HTTP headers
    tcp-request inspect-delay 5s
    # use CF-Connecting-IP header as identifier
    tcp-request content track-sc0 hdr(CF-Connecting-IP)

    tcp-request content reject if { sc0_get_gpc0 gt 0 }

backend www-backend
    # ...
    # back-end config details skipped
    # ...

    # prevent new requests for 300 seconds from someone who got more than 10 HTTP errors in 60 seconds
    stick-table type string len 40 size 1m expire 300s store http_err_rate(60s)
    acl abuse sc1_http_err_rate ge 10
    # tell front-end to reject future requests for this address
    # (replace www-https with your front-end name)
    acl flag_abuser sc0_inc_gpc0(www-https) gt 0

    # wait for at most 5 seconds for HTTP headers
    tcp-request inspect-delay 5s
    # use CF-Connecting-IP header as identifier
    tcp-request content track-sc1 hdr(CF-Connecting-IP)
    tcp-request content reject if abuse flag_abuser

如果您希望在日志中看到headers，请按以下方式添加capture指令：

    option httplog
    capture request header cf-connecting-ip len 100
    capture request header x-forwarded-for len 100
    log stdout format raw daemon

Answer 2

你必须从你的利率限制中白化他们的IP。

https://www.cloudflare.com/ips

因此，您的ACL应该类似于(不确定是否完全正确)：

acl rate_whitelist src -f /path/to/whitelist-ips
acl abuse src_http_req_rate(domain) ge 100
acl flag_abuser src_inc_gpc0(domain)
tcp-request content reject if abuse flag_abuser !rate_whitelist

然后，您的whitelist-ips文件将是IP的列表(我认为，不确定格式是否正确)：

199.27.128.0/21
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/12