protecting nginx from dos attacks

Question

We have a following kind of setup:

internet ---> Load balancer ---> 6 nginx instances ---> 15 Tomcat instances

There is a very huge web traffic on this setup. We wanted to filter out all the treats and DoS attacks. I mean we want to protect this setup from all the vulnerabilities.

What kind of security is required here and at which point? Is it the Starting point? Maybe on every nginx instances?

Answer 1

There are multiple ways to do this. I'll be sharing a few common ones:

1. You can try to throttle requests (rate limiting) on your load balancer.
2. Use iptables to add additional security on all your instances
3. If possible, put some of your instances (eg databases) in a private subnet and put only those that need to interact with the internet in your public subnet (eg load balancer)
4. Log requests so blocking ip addresses is easy
5. For a more advanced setup, you can have your iptables "react" to the requests with intrusion detection and log analysis (eg psad)

The starting point is your load balancer but it's important to assume that your load balancer can be exploited (not just DDoS) so make sure you have hardened all instances to slow down the attacker.

The suggestions above depend on your setup. For example, the strategy is different if you're using ELB (AWS Elastic Load Balancer).