如何使用 Amazon EC2 负载均衡器防御 DoS 攻击？
我们通常使用iptables将IP地址列入黑名单。但在 Amazon EC2 中，如果连接经过弹性负载均衡器，则远程地址将被负载均衡器的地址替换，从而导致 iptables 无用。对于 HTTP 来说，显然找出真实远程地址的唯一方法是查看 HTTP 标头 HTTP_X_FORWARDED_FOR。对我来说，在 Web 应用程序级别阻止 IP 并不是一种有效的方法。
在这种情况下防御 DoS 攻击的最佳实践是什么？
在本文中，有人建议我们可以将 Elastic Load Balancer 替换为HAProxy。然而，这样做有一定的缺点，我正在尝试看看是否有更好的替代方案。
We usually blacklist IPs address with iptables. But in Amazon EC2, if a connection goes through the Elastic Load Balancer, the remote address will be replaced by the load balancer's address, rendering iptables useless. In the case for HTTP, apparently the only way to find out the real remote address is to look at the HTTP header HTTP_X_FORWARDED_FOR. To me, blocking IPs at the web application level is not an effective way.
What is the best practice to defend against DoS attack in this scenario?
In this article, someone suggested that we can replace Elastic Load Balancer with HAProxy. However, there are certain disadvantages in doing this, and I'm trying to see if there is any better alternatives.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我认为您已经描述了当前的所有选项。您可能想参与一些 AWS 论坛主题来投票支持解决方案 - Amazon 工程师和管理层愿意接受有关 ELB 改进的建议。
I think you have described all the current options. You may want to chime in on some of the AWS forum threads to vote for a solution - the Amazon engineers and management are open to suggestions for ELB improvements.
如果您使用 VPC 而不是 EC2-classic 部署 ELB 和实例，则可以使用安全组和网络 ACL 来限制对 ELB 的访问。
http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide /USVPC_ApplySG.html
If you deploy your ELB and instances using VPC instead of EC2-classic, you can use Security Groups and Network ACLs to restrict access to the ELB.
http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/USVPC_ApplySG.html
在反向代理后面运行应用程序服务器是很常见的。您的反向代理是一个可用于在流量到达应用程序服务器之前添加 DoS 保护的层。对于 Nginx，您可以查看速率限制模块作为可能有帮助的东西。
It's common to run an application server behind a reverse proxy. Your reverse proxy is layer you can use to add DoS protection before traffic gets to your application server. For Nginx, you can look at the rate limiting module as something that could help.
您可以自己设置一个 EC2 主机并在那里运行 haproxy（这就是 Amazon 正在使用的！）。然后您可以在该系统上应用 iptables-filters。
You could set up an EC2 host and run haproxy there by yourself (that's what Amazon is using anyways!). Then you can apply your iptables-filters on that system.
这是我为那些希望在 aws 上通过 apache、ELB 和 ACL 使用 Fail2Ban 的人制作的一个工具：https: //github.com/anthonymartin/aws-acl-fail2ban
Here's a tool I made for those looking to use Fail2Ban on aws with apache, ELB, and ACL: https://github.com/anthonymartin/aws-acl-fail2ban