Block ip address (in Traefik?)

[jankeesvw]

I'm currently "under attack" by someone who is hammering my server, I tried using UFW but it seems that traffic isn't going through the firewall. Is there a way in Kamal to block a certain IP address when it misbehaves?

[scart88]

You can try https://github.com/rack/rack-attack or the new Rails rate_limiter

class PostsController < ApplicationController
  RATE_LIMIT_STORE = ActiveSupport::Cache::RedisCacheStore.new(url: ENV["REDIS_URL"])
  rate_limit to: 100, within: 1.minute, store: RATE_LIMIT_STORE, by: -> { client_ip }, only: :index
  
  ...
  
  def client_ip
    request.headers["HTTP_X_REQUEST_ID"] or whatever IP you can get
  end

Alternatively, you can use https://github.com/fail2ban/fail2ban

[jankeesvw]

Thanks, I'm already using rate_limit. But the CPU's where completely maxed out by Traefik, so even before it touched my Rails app.

[nickhammond]

@jankeesvw You might also look at options at your hosting provider(security group, virtual firewall), you could block all requests from the source IP.

[jankeesvw]

I'm using DigitalOcean, but they don't offer any options to block specific IPs. I ended up resorting to Cloudflare. See this comment: #926 (reply in thread).

[dhh]

I can also highly recommend Cloudflare for DDoS protection, although if your origin IP is already under attack, maybe that's a little late.

[jankeesvw]

I installed Cloudflare as a nameserver, but the attacker was still connecting directly to the origin IP. I resolved this by creating a new droplet and setting it up – which only took a few minutes thanks to Kamal.

It would be great if Kamal had a solution for this. I'd prefer not to have Cloudflare sitting between my server and my users. How do you handle this at 37Signals, @dhh?

But I'm glad the attack is over now.

[dhh]

There's nothing that'll protect a single droplet from a DDoS attack, unfortunately. You need a monster pipe and sophisticated network gear. That's why Cloudflare is so popular.

Thankfully DDoS attacks are generally quite rare. We've only had a couple in 20+ years. But when they happen, you need a big, mean network brute to handle it. Cloudflare is that.