Auto Blacklist Bot IPs using GET requests in NGINX

Question

I am fairly new to NGINX, so sorry if this question appears stupid, but here is my case.

I am experiencing a DDoS layer 7 get attack. I want to blacklist all the IPs that are making GET request. For 24 hours there are more than 1 000 000 unique IPs that are entering my website (according to my access log), which will make it impossible to go and deny them one by one.

So far I tried Limiting the Rate of Requests, Limiting the Number of Connections, Closing Slow Connections, but sadly this is not helping me. Nginx is still giving 500 error, and from time to time error 503 service unavailable.

So, my goal is to deny all the IPs that are making a GET request, but it has to be an automatic process, because otherwise it would be an impossible job.

Answer 1

Issue happens because of string:

error_page 404 = /index.php?$query_string;

This string means, that if you return 404, execute php-code. Try to comment this string.