Nginx reverse proxy protects against Bot attacks

With the development of Internet technology, preventing Web attacks has become an important issue in website security. As an automated attack tool, Bot has become one of the main forms of web attacks. In particular, Nginx, which serves through reverse proxy, has been widely used because of its efficiency, stability, flexibility and customization. This article will provide some effective preventive measures against Bot attacks under Nginx reverse proxy.

1. Turn on Access Log

Nginx provides the Access Log function, which can record the HTTP protocol, source IP, request time, response status code and other information of each request. By turning on Access Log, Bot attacks can be more easily detected.

Add the following content in the Nginx configuration file:

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    ……
}

2. Add restricted IP

Add the method of restricting IP in the Nginx configuration file to effectively prevent specific Regional IP attacks. For example, adding the following can prevent attacks from mainland China:

http {
    deny   61.135.0.0/16;
    deny   118.25.0.0/16;
    ……
}

3. Use the GeoIP module

Nginx's GeoIP module can match the access source IP with its geographical location. Simply install the GeoIP module and GeoIP library and use GeoIP variables to detect IP origin regions. For example:

http {
    geoip_country /usr/share/GeoIP/GeoIP.dat;
    geoip_city    /usr/share/GeoIP/GeoIPCity.dat;

    server {
        location / {
            if ($geoip_country_code = CN) {
                return 403;
            }

            if ($geoip_city_name ~* "moscow") {
                return 403;
            }
        }
    }
}

4. Add HTTP Referer verification

HTTP Referer can be used to verify the source of the request. Just add the following content to the Nginx configuration file:

http {
      server {
            if ($http_referer ~* (blacklist1|blacklist2|blacklist3)) {
                    return 403;
            }
      }
}

5. Use Nginx to prevent CC attacks

Nginx provides some functions to prevent CC attacks. Just set it in the Nginx configuration file:

http {
      limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

      server {
            location / {
                  limit_req zone=one burst=5;
                  ……
            }
      }
}

6. Enable SSL certificate

By enabling the SSL certificate, you can prevent data theft and man-in-the-middle attacks at the HTTP protocol level. At the same time, the HTTP Strict Transport Security (HSTS) mechanism can be enabled to prevent HTTP requests from being forcibly converted into HTTP requests, thereby enabling all access to be accessed via HTTPS in the future.

http {
      server {
            listen 443 ssl;

            ssl_certificate /path/to/cert;
            ssl_certificate_key /path/to/key;

            add_header Strict-Transport-Security "max-age=315360000; includeSubDomains; preload;";
      }
}

Summary

The security of Nginx reverse proxy server directly affects the security of the entire Web application system. For Bot attacks, by turning on Access Log, adding restricted IPs, using the GeoIP module, adding HTTP Referer verification, using Nginx to prevent CC attacks and enabling SSL certificates, etc., you can help the Nginx reverse proxy server avoid fake requests and malicious attacks, and protect Web application system security.

The above is the detailed content of Nginx reverse proxy protects against Bot attacks. For more information, please follow other related articles on the PHP Chinese website!