On Thu, Feb 23, 2023 at 06:48:14PM -0700, Bryan Arenal wrote: > Hi there, > > I’m seeing some traffic from what appears to be bad actors and am > wanting to block them. I see this in the existing config but being > new to haproxy, it doesn’t seem like it’s configured correctly but I’m > not sure: > > frontend main > bind :80 > acl bad_ip src > acl bad_ip_proxy hdr_ip(X-Forwarded-For) Off the top of my head, this should probably be: acl bad_ip src -f /etc/haproxy/blocklist.lst acl bad_ip_proxy hdr_ip(X-Forwarded-For) -f /etc/haproxy/blocklist.lst
> tcp-request connection reject if bad_ip || bad_ip_proxy I'm not sure offhand about the processing order for the header case. You might need BOTH: tcp-request connection reject if bad_ip || bad_ip_proxy http-request connection reject if bad_ip || bad_ip_proxy Depending on the scale of the traffic, the one problem you'll have here is that HAProxy still has to process the problematic requests. In that case I suggest writing a feedback loop that adds the bad IP to an ipset set, to block the traffic before it gets to HAProxy, for some period of time. The trigger for the loop can either be a tail on the logfile, or using some variation of the set* functionality (set-acl, set-map, set-mark) and exporting the data to ipset. -- Robin Hugh Johnson Pronouns : They/he E-Mail : [email protected]
signature.asc
Description: PGP signature
