[Syracusia]

You don't solve DDoS attacks you mitigate them, which using NGINX over Apache would actually do to some degree.

HF at this time runs on Apache 2.2.22 (Debian) which apparently has some denial of service problems.

Please don't talk about a topic you are ignorant on.

You mitigate attacks, by solving how they work and making a SOLUTION. This isn't just adding some reverse proxy which can handle a 50Gb/s layer 4 flood. This is solving how we can detect and firewall these attacks before they hit the server.

You fail to understand that the attack is not manifesting from a vulnerability in Apache itself.

[Omniscient]

Read about PFSense https://www.pfsense.org I would love to play around with that.

Although technically Apache could be more effective for a website which is mainly PHP based.

Which is why I still use and even to a degree, require Apache. We are a heavily php based site.

So for a forum, your apache setup isn't as bad as you think. In fact it might be a lot better.

I like Apache a lot. I have no plans to drop it. Just put Nginx in front of it. Dynamic content shouldn't be served by Nginx. Just not how it should be done.

We can run some tests over summer and collect performance data.

Also lets do the rework on an alternate server so there is no downtime, once we have tested and ensured everything is working then we can migrate the solution onto our main content server.

There are lot of "we" in that statement.

[Syracusia]

Read about PFSense https://www.pfsense.org I would love to play around with that.

Which is why I still use and even to a degree, require Apache. We are a heavily php based site.

I like Apache a lot. I have no plans to drop it. Just put Nginx in front of it. Dynamic content shouldn't be served by Nginx. Just not how it should be done.

There are lot of "we" in that statement.

I will begin researching into pfSense.

Agreed, that is how the ideal website should operate. Nginx for static Apache for dynamic

And yes a lot of "we" as I believe I have a lot to offer and could help you make an amazing web solution.

I have an understanding of how these attacks work from the ground up and how to develop solutions to detect and stop them.

[Omniscient]

And yes a lot of "we" as I believe I have a lot to offer and could help you make an amazing web solution.

Yeah but no. Sorry but no one touches my configuration.

I have an understanding of how these attacks work from the ground up and how to develop solutions to detect and stop them.

I don't have need for your help but I'm sure a lot of members do. You should offer them help since they might be more receptive to it.

[clark.dll]

Fucking losers with nothing better to do than target a site they were probably banned from. Sorry you have to go through all of this shit just because somebody has too much time on their hands. Thanks for giving us more information regarding the downtime.

[Syracusia]

Yeah but no. Sorry but no one touches my configuration.

I don't have need for your help but I'm sure a lot of members do. You should offer them help since they might be more receptive to it.

I understand completely, I am the same way.

Figured I would give the offer.

Please keep in touch with me though, despite not being able to work together we can still bounce ideas off each other.

My email is: [email protected]

I can send you other contact information if you prefer another method.

Hope you make an effective solution! 🤝

[AlphaDelta]

Please don't talk about a topic you are ignorant on.

You mitigate attacks, by solving how they work and making a SOLUTION. This isn't just adding some reverse proxy which can handle a 50Gb/s layer 4 flood. This is solving how we can detect and firewall these attacks before they hit the server.

You fail to understand that the attack is not manifesting from a vulnerability in Apache itself.

Sweetheart I wasn't implying the problem was a result of an vulnerability of Apache I was merely pointing out the fact that the server software was outdated and it was unrelated to your reply, it was my fault for structuring my response in a way that it could have been easily misconstrued.

You have however pointed out that I was wrong about my initial point, thank you for that, but you worded it in a way that is insulting and I'd just like to point out that if it were intentional I'd advise you to talk a little bit nicer, people aren't going to listen to you if you're insulting or talking down to them.

[Syracusia]

Sweetheart I wasn't implying the problem was a result of an vulnerability of Apache I was merely pointing out the fact that the server software was outdated and it was unrelated to your reply, it was my fault for structuring my response in a way that it could have been easily misconstrued.

You have however pointed out that I was wrong about my initial point, thank you for that, but you worded it in a way that is insulting and I'd just like to point out that if it were intentional I'd advise you to talk a little bit nicer, people aren't going to listen to you if you're insulting or talking down to them.

Sorry if I come off blunt, I just don't sugarcoat stuff. Not because I don't want to, simply because it is unnecessary for me to.

[Dan.]

I assume you're not a litespeed fan.

[Angel Beats‌‌]

What the fuck? Simply using NGINX wouldn't solve this problem.

It's not an exploit manifesting from the apache server.

It's the fact that the server is having to process thousands of malicious requests every second.

Actually having nginx as the frontend would help a huge amount, you could block incorrect host records with ease, while using barely any resources.

['An0ny]

Actually having nginx as the frontend would help a huge amount, you could block incorrect host records with ease, while using barely any resources.

You can do that with Apache too.

However I am not completely sure how, for nginx it's done automatically for me with virtual hosts.

I made all invalid virtual hosts go to the default nginx page, someone attacked it so i made it return 0 bytes (444) and boom issue fixed.

Code

server {
      listen   80 default_server;
      return 444;

      }

apache will have issue handling this much traffic i think

[Angel Beats‌‌]

You can do that with Apache too.

However I am not completely sure how, for nginx it's done automatically for me with virtual hosts.

I made all invalid virtual hosts go to the default nginx page, someone attacked it so i made it return 0 bytes (444) and boom issue fixed.

Code

server {
      listen   80 default_server;
      return 444;

      }

apache will have issue handling this much traffic i think

Apache doesnt support 444 thats what I was saying.

[Repeat]

You're both stupid. He doesn't need your help nor did he ask for it.

['An0ny]

You're both stupid. He doesn't need your help nor did he ask for it.

Shut the fuck up, he made a discussion thread which means we're allowed to discuss it. Not just ass kiss and say good luck.

Going to have to discuss this openly to members.

[XPRMX]

if anything why not add load balancing servers i am not sure if you already have those in place or not. I am not really a fan of cloudflare because if you buy 1 product from them you need to buy a thousand more for that 1 product to work.