[Omniscient]

For those wondering why they get slow HF loads or maybe just curious how HF is served...I made this new chart which represents most of how HF is served to you.



I'll try to explain the image and elaborate a bit.

We start at CF (Cloudflare) which has a WAF (Web Application Firewall) and a lot of rulesets. Once we go through HF security we have Sucuri which again has DDOS protection and assists in grabbing traffic that CF doesn't block. I don't always have Sucuri enabled as it tends to have a higher rate of false positives and their setup is sometimes buggy.

Next we hit a server which has an OS kernel based firewall which I personally manage. It's also a tunnel server. Packets that hit this server are then tunneled to the next server which runs Nginx.

Nginx has some modules for DDOS protection. Nginx serves all the static content. It then forwards any php requests to Apache. You may wonder why I don't use Nginx to forward to Apache but I have my reasons. I have some custom written modules for Apache that I can't replace with Nginx. These modules enhances HF security and ddos protection. They are irreplaceable. Once you pass Nginx though you do get forwarded to Apache which as I stated does have a lot of modules and is setup fairly well.

Apache will forward the PHP calls to the PHP CGI processor. That's when the nuts and bolts of the actual serving of the page truly begins. PHP grabs the database (different server) information and serves your browser the page.

And so that's why HF doesn't load in .5 seconds and miraculously does load in just 2-3 seconds (most pages anyways).

This setup has taken me years to mature into with layers being added as needed based on attacks, security requirements, technology changes, and the size of HF itself.

So when I get a PM saying a person is blocked or having slow page loads you must understand that it's not a 10 second (or even 10 minute) fix to figure out why one user is having a problem. Each layer has protections which could slow you down or even block you.

For those who doubt that we need all this....



That's the past month. It's nearly 3 BILLION requests and that's over 60 TB of traffic too. And yet our downtime is for the most part minimal in comparison to the sizes of the attacks.

Sometimes attacks are worse too. Cloudflare just lets me display past month.

And that's not everything either. It's just what I'm willing to post about. Do we go offline sometimes? Yes, we do. And I'm sure we'll continue to be attacked regularly. I never honestly care about who is attacking or why they are. My only concern is keeping HF online. At this point there is a lot of automation built into protection. Some protections are always enabled while others toggle on/off based on attack patterns. And there is always things I can do manually.

After the past 10 days of rather large attacks I went into a few of our layers and tightened them up. We should see even better uptime now. Doubt a day will ever come where we will see 100% uptime but I'm happy with even 98% considering the frequency of attacks.

Thank you.

[Nachfolger]

Interesting explanation. Probably needed for those who hate on the loadtimes.

Thanks.

[Jordana Brewster]

That is a ton of security, but... looks like it's needed

[KFC Watermelon]

HackForums usually loads very quick for me. This page took 477ms to load according to Chrome's network debugger. Great work on the setup!

[felicixus]

Nice system!
Do you think attackers can now use targeted attack after this lesson on how HF is served?

[Fortunate]

This very cool and interesting, i have always wondered how HF runs, thanks.

[Azylum]

Now that's what i call security.
Great job.

[Wоlf]

Behind the scenes on how protected hackforums really is and how many attacks it gets. Thanks for the info omni!

[Neeeeeeeeeel.-]

Wow, what a complex structure! I thought it was too much simple like CP -> Firewall -> HF Server

[Omniscient]

Nice system!
Do you think attackers can now use targeted attack after this lesson on how HF is served?

We'll get attacked anyways. I'm sure this thread will inspire a moron or two to do so almost immediately. I've seen attacks sustained for 3 days that didn't do much more than 1 second page load delays. My guess is the butthurt ban evaders are the ones who most likely attack.

If we get attacked and go offline it's not something I whine about. I deal with it and move on. If we're offline 3 minutes or 3 hours then so be it. I just site here and work on it. Attacks are part of my daily routine and don't effect me personally.

Just be patience and HF will eventually come back. Follow the Twitter as I use it to announce long downtimes.

[Headdy]

Now that was an interesting read!

I enjoy insight topics :)

[webdev77]

Pretty cool setup that exists here. I appreciate the time and effort that has been taken to keep us online here.

[Rubixa]

Crazy setup but definitely needed.. almost 3 billion in the past month, that's insane. Thanks heaps for sharing how we access the site on the daily, was definitely an interesting read.

[Bluffer]

I recall a few months ago when my site was constantly getting attacked and it really sucks.

It's cool that with your experience you are able to find so many ways to block the attacks or redirect them. Nice job!

[Omniscient]

I recall a few months ago when my site was constantly getting attacked and it really sucks.

It's cool that with your experience you are able to find so many ways to block the attacks or redirect them. Nice job!

I think if I didn't have HF I'd work in DDOS protection maybe. Not that it's my favorite thing to do but I've become adept at it simply out of necessity.