nginx prevent process undefined server names

Use default_server to prevent processing requests with undefined server names

http {
...

  server {
    listen 80 default_server;
    listen [::]:80 default_server;
    # close connection
    return 444;
  }
}

If use http to https redirect

http {
...
  server {
    listen 80;
    listen [::]:80;
    name_server _;

    location ^~ /.well-known/acme-challenge {
      # Install https://certbot.eff.org/
      # letsencrypt/certbot certonly --webroot --email [email protected] --agree-tos --sta$
      default_type text/plain;
      root /etc/letsencrypt/webroot;
      try_files $uri $uri/ =404;
    }

    location / {
      # redirect all requests to https
      return 301 https://$host$request_uri;
    }
  }

  server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    name_server _;
    # Enable SSL
    ssl on;
    ssl_certificate /etc/ssl/private/local.crt;
    ssl_certificate_key /etc/ssl/private/local.key;
    # close connection
    return 444;
  }
}

 

Simple DDOS Mitigation with iptables

edit /etc/sysctl.d/60-ddos.conf
and run
sysctl -p/etc/sysctl.d/60-ddos.conf

# Kernel sysctl configuration file for Linux
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
# sysctl.conf(5) for more details.

# Turn on execshield
# 0 completely disables ExecShield and Address Space Layout Randomization
# 1 enables them ONLY if the application bits for these protections are set to “enable”
# 2 enables them by default, except if the application bits are set to “disable”
# 3 enables them always, whatever the application bits
kernel.exec-shield = 2
kernel.randomize_va_space = 2

# Controls IP packet forwarding
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Controls source route verification
net.ipv4.conf.default.rp_filter = 2

# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0

# Ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1

# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1

# Disable netfilter on bridges.
#net.bridge.bridge-nf-call-ip6tables = 0
#net.bridge.bridge-nf-call-iptables = 0
#net.bridge.bridge-nf-call-arptables = 0

# Controls the default maxmimum size of a mesage queue
kernel.msgmnb = 65536

# Controls the maximum size of a message, in bytes
kernel.msgmax = 65536

# Controls the maximum shared segment size, in bytes
kernel.shmmax = 68719476736

# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 4294967296

# See also http://www.nateware.com/linux-network-tuning-for-2013.html for
# an explanation about some of these parameters, and instructions for
# a few other tweaks outside this file.

# Protection from SYN flood attack.
net.ipv4.tcp_syncookies = 1

# See evil packets in your logs.
net.ipv4.conf.all.log_martians = 0

# Discourage Linux from swapping idle server processes to disk (default = 60)
vm.swappiness = 10

# Tweak how the flow of kernel messages is throttled.
#kernel.printk_ratelimit_burst = 10
#kernel.printk_ratelimit = 5

# --------------------------------------------------------------------
# The following allow the server to handle lots of connection requests
# --------------------------------------------------------------------

# Increase number of incoming connections that can queue up
# before dropping
net.core.somaxconn = 50000

# Handle SYN floods and large numbers of valid HTTPS connections
# https://shehab.tech/
net.ipv4.tcp_max_syn_backlog = 30000

# Increase the length of the network device input queue
net.core.netdev_max_backlog = 20000

# Increase system file descriptor limit so we will (probably)
# never run out under lots of concurrent requests.
# (Per-process limit is set in /etc/security/limits.conf)
fs.file-max = 100000

# Widen the port range used for outgoing connections
net.ipv4.ip_local_port_range = 10000 65000

# If your servers talk UDP, also up these limits
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192

# --------------------------------------------------------------------
# The following help the server efficiently pipe large amounts of data
# --------------------------------------------------------------------

# Disable source routing and redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0

# Disable packet forwarding.
#net.ipv4.ip_forward = 0
#net.ipv6.conf.all.forwarding = 0

# Disable TCP slow start on idle connections
net.ipv4.tcp_slow_start_after_idle = 0

# Turn on the tcp_window_scaling
net.ipv4.tcp_window_scaling = 1

# Turn on the tcp_timestamps
net.ipv4.tcp_timestamps = 1

# Turn on the tcp_sack
net.ipv4.tcp_sack = 1

# Change Congestion Control (default: cubic or htcp)
net.ipv4.tcp_congestion_control=cubic

# Increase Linux autotuning TCP buffer limits
# Set max to 16MB for 1GE and 32M (33554432) or 54M (56623104) for 10GE
# Don't set tcp_mem itself! Let the kernel scale it based on RAM.
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 33554432
net.ipv4.tcp_wmem = 4096 87380 33554432


# --------------------------------------------------------------------
# The following allow the server to handle lots of connection churn
# --------------------------------------------------------------------

# Disconnect dead TCP connections after 1 minute
net.ipv4.tcp_keepalive_time = 60

# SYNPROXY
net.netfilter.nf_conntrack_max = 10000000
net.netfilter.nf_conntrack_tcp_loose = 0

# Wait a maximum of 5 * 2 = 10 seconds in the TIME_WAIT state after a FIN, to handle
# any remaining packets in the network.
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10

# How long to keep ESTABLISHED connections in conntrack table
# Should be higher than tcp_keepalive_time + tcp_keepalive_probes * tcp_keepalive_intvl )
net.netfilter.nf_conntrack_tcp_timeout_established = 300
net.netfilter.nf_conntrack_generic_timeout = 300

# Allow a high number of timewait sockets
net.ipv4.tcp_max_tw_buckets = 2000000

# Timeout broken connections faster (amount of time to wait for FIN)
net.ipv4.tcp_fin_timeout = 10

# Let the networking stack reuse TIME_WAIT connections when it thinks it's safe to do so
net.ipv4.tcp_tw_reuse = 1

# Determines the wait time between isAlive interval probes (reduce from 75 sec to 15)
net.ipv4.tcp_keepalive_intvl = 15

# Determines the number of probes before timing out (reduce from 9 sec to 5 sec)
net.ipv4.tcp_keepalive_probes = 5

/etc/iptables.up.rules

# Generated by iptables-save v1.6.0 on Thu Mar 30 00:19:26 2017
*raw
:PREROUTING ACCEPT [1324:102679]
:OUTPUT ACCEPT [110:12756]
# Don't track SYN packets
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CT --notrack
COMMIT
# Completed on Thu Mar 30 00:19:26 2017
*mangle
:PREROUTING ACCEPT [1324:102679]
:INPUT ACCEPT [1248:94938]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [110:12756]
:POSTROUTING ACCEPT [110:12756]
# Allow loopback
-A PREROUTING -i lo -j ACCEPT
# Drop TCP packets that are new and are not SYN
-A PREROUTING -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
# Drop SYN packets with suspicious MSS value
-A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
# Block packets with bogus TCP flags
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
# Block spoofed packets
-A PREROUTING -s 224.0.0.0/3 -j DROP
-A PREROUTING -s 169.254.0.0/16 -j DROP
-A PREROUTING -s 172.16.0.0/12 -j DROP
-A PREROUTING -s 192.0.2.0/24 -j DROP
-A PREROUTING -s 192.168.0.0/16 -j DROP
-A PREROUTING -s 10.0.0.0/8 -j DROP
-A PREROUTING -s 0.0.0.0/8 -j DROP
-A PREROUTING -s 240.0.0.0/5 -j DROP
-A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP
# Drop fragments in all chains
-A PREROUTING -f -j DROP
COMMIT
# Completed on Thu Mar 30 00:19:26 2017
# Generated by iptables-save v1.6.0 on Tue Mar 28 11:50:15 2017
*nat
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Thu Mar 30 00:19:26 2017
# Generated by iptables-save v1.6.0 on Tue Mar 28 11:50:15 2017
*filter
:INPUT ACCEPT [1246:94823]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [110:12756]
:port-scanning - [0:0]
# Allow loopback
-A INPUT -i lo -j ACCEPT
# Allow current connection
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#Limiting the incoming icmp ping request: 
-A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT
-A INPUT -p icmp -j DROP
# Simple DDOS Migation by SYNPROXY
-A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 -m multiport --dports 22,80,443
-A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 -m multiport --dports 8080,8443
-A INPUT -m conntrack --ctstate INVALID -j DROP
# SSH brute-force protection
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSHBF --rsource
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 --name SSHBF --rsource -j DROP
# Protection against port scanning
-A port-scanning -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec --limit-burst 2 -j RETURN
-A port-scanning -j DROP
# Allow Apps
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 22,80,443
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 8080,8443
# Default DROP
-A INPUT -j DROP
COMMIT
# Completed on Thu Mar 30 00:19:26 2017

/etc/ip6tables.up.rules

# Generated by iptables-save v1.6.0 on Thu Mar 30 00:19:26 2017
*raw
:PREROUTING ACCEPT [1324:102679]
:OUTPUT ACCEPT [110:12756]
# Don't track SYN packets
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CT --notrack
COMMIT
# Completed on Thu Mar 30 00:19:26 2017
# Generated by iptables-save v1.6.0 on Tue Mar 28 11:50:15 2017
*filter
:INPUT ACCEPT [1246:94823]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [110:12756]
:port-scanning - [0:0]
# Allow loopback
-A INPUT -i lo -j ACCEPT
# Allow current connection
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#Limiting the incoming icmp ping request: 
-A INPUT -p ipv6-icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT
-A INPUT -p ipv6-icmp -j DROP
# Simple DDOS Migation by SYNPROXY
-A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 -m multiport --dports 22,80,443
-A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 -m multiport --dports 8080,8443
-A INPUT -m conntrack --ctstate INVALID -j DROP
# SSH brute-force protection
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSHBF --rsource
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 --name SSHBF --rsource -j DROP
# Protection against port scanning
-A port-scanning -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec --limit-burst 2 -j RETURN
-A port-scanning -j DROP
# Allow Apps
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 22,80,443
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 8080,8443
# Default DROP
-A INPUT -j DROP
COMMIT
# Completed on Thu Mar 30 00:19:26 2017
# Generated by iptables-save v1.6.0 on Tue Mar 28 11:50:15 2017
*mangle
:PREROUTING ACCEPT [1324:102679]
:INPUT ACCEPT [1248:94938]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [110:12756]
:POSTROUTING ACCEPT [110:12756]
COMMIT
# Completed on Thu Mar 30 00:19:26 2017
# Generated by iptables-save v1.6.0 on Tue Mar 28 11:50:15 2017
*nat
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Thu Mar 30 00:19:26 2017

Debian,Ubuntu load iptables
/etc/network/if-pre-up.d/iptablesload
chmod +x /etc/network/if-pre-up.d/iptablesload

#!/usr/bin/env bash
sysctl -p/etc/sysctl.d/60-ddos.conf > /dev/null 2>&1
iptables-restore < /etc/iptables.up.rules
ip6tables-restore < /etc/ip6tables.up.rules
exit 0

RHEL,Centos load iptables

#!/usr/bin/env bash
sysctl -p/etc/sysctl.d/60-ddos.conf > /dev/null 2>&1
systemctl mask firewalld
yum -y install iptables-services
systemctl enable iptables
systemctl enable ip6tables
iptables-restore < /etc/iptables.up.rules
ip6tables-restore < /etc/ip6tables.up.rules
ln -sf /etc/iptables.up.rules /etc/sysconfig/iptables
ln -sf /etc/ip6tables.up.rules /etc/sysconfig/ip6tables
exit 0