['An0ny]

How I'm currently setup the bypass is effective. I relay that info in the first post. The amount of traffic hitting Apache chokes it. So ANY suggestion to use .htaccess or any Apache based rule will not be effective. I've tried to make that clear and people still send me the suggestion.

I think what you are doing now should be fine, hopefully CloudFlare will prevent this. I think that white page / cookie check is annoying people, but i'd rather see a white page here and there than downtime.

Any certain reason you are using Apache? I've had nothing but issues with Apache when getting attacks. It kills it easily. I am using plain nginx my self, and set up my own rule(s) to prevent it which so far seems to work.

[lemmon]

CloudFlare have been working fine till now, this exploit & the other cf bypass are both working fine to bypass CloudFlare. But there are some rules you could do to prevent it, which hes doing now.

I am using CloudFlare free fine, i think PRO would be more than enough as they've also increased the r/s limit.

Someone probably hasn't hit your site with a big enough botnet then, Cloudflare Free wont protect your site with that much traffic with or without the exploit.

['An0ny]

Someone probably hasn't hit your site with a big enough botnet then, Cloudflare Free wont protect your site with that much traffic with or without the exploit.

CloudFlare free or pro or business has no difference if this exploit is out. So I don't understand your statement.

[lemmon]

Any certain reason you are using Apache? I've had nothing but issues with Apache when getting attacks. It kills it easily. I am using plain nginx my self, and set up my own rule(s) to prevent it which so far seems to work.

He mentioned that he wrote modules and enjoys the features for apache in a previous post.

['An0ny]

He mentioned that he wrote modules and enjoys the features for apache in a previous post.

Yup, just took me time to read the entire topic.

Maybe one day you'll move to Nginx 😊

Using nginx as front end proxy should prevent it/stop the attacks/decrease.

[Abraham Lincoln]

CloudFlare free or pro or business has no difference if this exploit is out. So I don't understand your statement.

Pro costs much less than a business account.

All you get is better support (which he feels is bad and not worth it)

[Omniscient]

Any certain reason you are using Apache? I've had nothing but issues with Apache when getting attacks.

Realize I've been using Apache since before Nginx was even a project. I know it's not optimal for my environment but certain things I still need it for. All my custom stuff is written as Apache modules which won't be easy, fun, or quick to write for Nginx.

Maybe one day you'll move to Nginx

After the 2nd downtime we had a couple weeks ago I realized I needed to add it to prevent these attacks. I don't have time though to really do what I need so for now it's a double ddos protection.

Using nginx as front end proxy should prevent it/stop the attacks/decrease.

Correct. As well as give me other control options as well. It's not a matter of knowing how to do it...it's a matter of having the time to make the changes. Especially considering I already plan hardware changes this summer. I'm going to wait till that happens before change more deeply our serving structure.

Pro costs much less than a business account.

It's not about cost me for me on this. It's more that I don't want to see CF get money for a service it doesn't actually provide. I'm contemplating calling them out on their 100% uptime guarantee but for now I'd rather keep my friendly disposition with them while I still use their service.

['An0ny]

-

Understandable, i assume once you get some time you'll move to Nginx one day. I would assume this would save the server a lot of resource usage, and possibly costs.

What you are using now should be fine, let's hope CloudFlare get their asses and fix this stupid "exploit". Can barely call it exploit, embarrassing for them.

:) sucks I couldn't help.

[bfreakz]

I was unable to access HF for about 24 hours. Kept saying my country was blocked, however now it works? Can you give any input Omni. I know you don't discuss country bans, but I really can't afford paying a VPN to access HF if this will keep happening.

[Blazin]

This sucks hope you get it all sorted Omni

[Omniscient]

I was unable to access HF for about 24 hours. Kept saying my country was blocked, however now it works? Can you give any input Omni. I know you don't discuss country bans, but I really can't afford paying a VPN to access HF if this will keep happening.

Obvious. Your country was blocked. Now it's not.

[Charlemagne]

I am trying to think of some way that would fix this, but I know nothing about web development. All I can offer you, Omni, is a wish of luck when trying to fix this.

[Doxicity]

Sucks to hear this, but I'm sure you'll fix it all in due time.

Serious question though, does this mean Chile has been blocked again?

[Canonsx130]

A very nice read. You should sticky this and give yourself the sticky award. This was very informative.

EDIT: It's stuck already. Thanks :D

[Prince™]

Damn, looks like you spent a hell of a time with Cloudflare support to get this resolved.

Good to see HF back on track Omni, thank you!