[Warriors] Create your own reverse Proxy

[Warriors] Create your own reverse Proxy - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Warriors] Create your own reverse Proxy (/showthread.php?tid=6130196)

Pages: Pages 1 2

[Warriors] Create your own reverse Proxy - guardian - Dec 29, 2020

There are numerous situations, where a reverse proxy for your web server can be useful
It is pretty easy to setup, however, depending on your operation, you might need some additional configuration

We will set up an Nginx on our server with IP 5.206.xxx.xxx, which will act as a reverse proxy and pass our requests to 1.1.1.1 (Cloudflare App)

Installing Nginx

Code 
apt -y install nginx

After a successful installation of nginx, head over to the configuration file

Code 
nano /etc/nginx/sites-enabled/default

Search for location and remove the following line:try_files $uri $uri/ =404;
Then replace it with

Code 
proxy_pass https://1.1.1.1

Instead of 1.1.1.1 you could use another site as well, maybe your own site, in order to hide it's IP?
Or a site you always want to access with the servers IP? (NOTE: You will have to take care of the forwarded by header then, which would reveal your real IP)

Now let's test the configuration

Code 
root@guardian:/etc/nginx/sites-available# nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

Restart and reload nginx and we are ready to go :)

Code 
systemctl restart nginx

systemctl reload nginx

Now on to the test, our server IP should now show the contents of 1.1.1.1, when accessed and ...
[Image: reverse-proxy-example.png]

It works! Our Nginx server now forwards all requests to 1.1.1.1

RE: [Tutorial] Create your own reverse Proxxy - AeS0p - Feb 25, 2021

Great post! thanks friend!

RE: [Tutorial] Create your own reverse Proxxy - duduch1995 - Apr 14, 2021

By doing this, does the server with the hidden ip (target server) not receive the attacks but the first one receive them?

RE: [Tutorial] Create your own reverse Proxxy - Criptex - Apr 14, 2021

Very short and sweet tutorial. Thanks for sharing.

RE: [Tutorial] Create your own reverse Proxxy - guardian - Apr 14, 2021

(Apr 14, 2021 05:54 PM)duduch1995 Wrote: By doing this, does the server with the hidden ip (target server) not receive the attacks but the first one receive them?

This depends on the attacks and how the server is set up. What kind of attacks are you talking about? DDoS? Hacking?

RE: [Tutorial] Create your own reverse Proxxy - duduch1995 - Apr 15, 2021

(Apr 14, 2021 11:06 PM)guardian Wrote: This depends on the attacks and how the server is set up. What kind of attacks are you talking about? DDoS? Hacking?

Im talking about DDoS Attacks yes

if for example I have a server that is DDoS protected and I do this method. Can he protect the other server?

thanks for your help

RE: [Tutorial] Create your own reverse Proxxy - guardian - Apr 15, 2021

(Apr 15, 2021 03:16 AM)duduch1995 Wrote: Im talking about DDoS Attacks yes

if for example I have a server that is DDoS protected and I do this method. Can he protect the other server?

thanks for your help

Absolutely. But you have to do a little more, in order to protect it than simply setting up a reverse proxy. You can use a reverse proxy as a so called "load balancer". The load balancer basically spreads the requests across your cluster of servers. It is hard to down a well set up load balancer, because it simply does not handle 'heavy' requests. You should also configure it to filter requests somehow. Requests that the system receives that are detected as malicious, should not be forwarded to your back end. You can also use some kind of captcha on your reverse proxy, like cloudflare does. A solved captcha generates a new session that lets the user access the website through the reverse proxy.

But preventing DDoS is pretty much impossible, you can only make it harder. If someone has enough power and some good endpoint to attack, he will probably be able to do it. Just try to make it as hard as possible for them, so most script kiddies cannot afford downing your site. As long as you don't get in trouble with the big boys, you should be good.

Here is a short summarization of some basic DDoS prevention methods:

(I assume you are not building some super big project that will be at high risk for DDoS attacks)

- Build a server cluster that consists of multiple servers that have enough power to handle your requests and also a bit more, in case someone should be able to get through with their bots
- Use a reverse proxy as a load balancer, I recommend Nginx
- Configure a WAF (= Web Application Firewall) with Nginx, I recommend 'Naxsi'
- Maybe use some sort of captcha solution or have one ready that you activate in case of an attack, it is not too hard to even code your own :)
- Use a super strict firewall on your back end server cluster, you can use the iptables command for that, only allow traffic that should be allowed, for instance: allow ssh connections so that you can connect to the server (I also recommend port knocking and using a non-common port for it, adds some extra security), allow traffic from and to your reverse proxy and localhost (i.e. for database stuff), this should be adapted, depending on your needs, the point is that your server should seem dead from the outside, because when someone finds out the IP of your server(s), they have more possible attack points for a DDoS
- Hiding your IP is important, because as I mentioned above, if someone finds out the true IP of your server and you did not set your firewall up correctly, they have a lot more options to attack you, so basically the reverse proxy would be pointless, maybe it would keep some skids away, but that is pretty much it, I already wrote a tutorial, about how someone can find the true IP behind cloudflare, this also applies for reverse proxies you set up on your own, maybe check that out
- Make sure to make the load requests can generate as small as possible, close database connections after the script is done, use prepared statements, load stuff from external sources ... list is endless, you have to find your way for that, as I don't know what kind of application you want to host
- Use some kind of filtering in your back end as well, even when using Naxsi or some other WAF on your front end, that way you have 2 instances checking the requests
- Make sure to log important stuff!! When a DDoS occurs and you are for some reason not able to defend yourself, you can view the log files and find out what you could have done to prevent it

That is some basic stuff that you as an admin of a site should take care of to prevent DDoS. There is other stuff as well, but I don't want to make this post too long and I also don't know what kind of application we are talking about. Hope I could help you.

RE: [Tutorial] Create your own reverse Proxxy - duduch1995 - Apr 15, 2021

So thank you for all this information, so for my part I want to integrate a reverse proxy for a FiveM server, it is not a web server but a connection IP and a specific port so what I want is mainly that the attacks are redirected to the Anti DDoS of my dedicated server and that user connections can pass all that, my AntiDDoS protection already manages this basic system so what I was thinking is that I could use this system to protect my second server (Fivem server)
But in any case I will try to focus on all that I thank you in advance for this tutorial and for all these explanations it will help me a lot for my current project and subsequently in my future projects

RE: [Tutorial] Create your own reverse Proxxy - guardian - Apr 15, 2021

(Apr 15, 2021 04:44 AM)duduch1995 Wrote: So thank you for all this information, so for my part I want to integrate a reverse proxy for a FiveM server, it is not a web server but a connection IP and a specific port so what I want is mainly that the attacks are redirected to the Anti DDoS of my dedicated server and that user connections can pass all that, my AntiDDoS protection already manages this basic system so what I was thinking is that I could use this system to protect my second server (Fivem server)
But in any case I will try to focus on all that I thank you in advance for this tutorial and for all these explanations it will help me a lot for my current project and subsequently in my future projects

This is a completely different scenario then. In this case the most important thing is your firewall and load balancer. Make sure to meticulously configure your firewall and reverse proxy. The stuff I told you about the firewall still applies. Only run necessary services and only allow those. Reject packets that are not received by a trusted source (i.e. your reverse proxy) and configure the reverse proxy to have some DDoS prevention going on. Don't forget to log, not too much, because this can also slow down the server, but essential stuff should be written to a log file.

RE: [Tutorial] Create your own reverse Proxxy - Shadow_Cloud - Apr 16, 2021

guardian has made some really good points on preventing DDOS earlier, the one thing I'd like to add is rate limiting by incoming IP on your proxy, you could detect an excessive amount of requests from a specific IP and either slow them down artificially or just drop the packets completely.

There's some really useful info on rate limiting here > https://www.nginx.com/blog/rate-limiting-nginx/

In the case of the FiveM server (I don't really know anything about it) do you have a specific request to initiate the connection initially? Because you could potentially check for the expected value and drop anything else that's not established. Its not foolproof but it should help quite a bit.

RE: [Tutorial] Create your own reverse Proxxy - darkhax0r - Apr 25, 2021

i got this error can anyone please solve this ?

nginx: [emerg] "proxy_pass" directive is not allowed here in /etc/nginx/sites-enabled/default:1
nginx: configuration file /etc/nginx/nginx.conf test failed

RE: [Tutorial] Create your own reverse Proxxy - Payne - May 30, 2021

Great post friend thank you so much

RE: [Tutorial] Create your own reverse Proxxy - guardian - May 30, 2021

(Apr 25, 2021 12:51 PM)darkhax0r Wrote: i got this error can anyone please solve this ?

nginx: [emerg] "proxy_pass" directive is not allowed here in /etc/nginx/sites-enabled/default:1
nginx: configuration file /etc/nginx/nginx.conf test failed

Seems like you used the wrong config file.

RE: [Tutorial] Create your own reverse Proxxy - [̲̅$̲̅(̲̅5̲̅)̲̅$̲̅] - Oct 23, 2021

I love the way you properly formatted this tutorial with the code tags. It made it very easy to read and follow.

RE: [Tutorial] Create your own reverse Proxxy - guardian - Oct 23, 2021

(Oct 23, 2021 04:12 PM)[̲̅$̲̅(̲̅5̲̅)̲̅$̲̅] Wrote: I love the way you properly formatted this tutorial with the code tags. It made it very easy to read and follow.

Thanks a lot! Glad you liked it and thanks for the feedback.