Find Jobs
Hire Freelancers

Nginx optimization and security

$30-250 USD

Dokončeno
Zveřejněno přibližně před 7 roky

$30-250 USD

Zaplaceno při doručení
I have centos with Nginx installed to work as reverse proxy, the issue is Nginx stop response on huge traffic on SSL port even the traffic dropped. example: nginx configured to listed on [login to view URL] on port 80 and 443, in below example, the nginx rule drop connection when User-Agent is around IE6(this is example). when start to make test ddos attack on this config using UA=IE6, on http port, the attack mitigate as well and all attack connection drop very fast,you never feel nginx become slow or anything, no Waiting connections or else, no issue here, but when do same on SSL port, the Nginx stop response on SSL port while it is still response on Http port. when i tried ss command it show listen Queue is full. while HTTP use same backlog size(511). LISTEN 512 511 [login to view URL] i tried to use backlog in nginx listen and increased backlog to 50000(less than [login to view URL]) but after start attack, the Queue will be full less than 30 seconds, the number of IP used to test attack is around 10000 IPs. i found nginx stop response on SSL port due to listen backlog is full on SSL port while it can response on HTTP because it is not full yet, but i dont understand, i used same config and same rules in Server block to Drop connection on special rule. normally nginx should drop connection on both HTTP and SSL port. but on SSL port it keep connection as CLOSE_WAIT OR LAST_ACK, example of conf: server { listen [login to view URL]; server_name [login to view URL]; location / { if ($http_user_agent ~* "IE6" ) { return 444; } return 200 "default page"; add_header Content-Type text/html; } } server { listen [login to view URL] ssl; server_name [login to view URL]; ssl_certificate [login to view URL]; ssl_certificate_key [login to view URL]; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH; ssl_session_cache shared:SSL:500m; ssl_session_timeout 10m; location / { if ($http_user_agent ~* "IE6" ) { return 444; } return 200 "default page"; add_header Content-Type text/html; } } example of [login to view URL]: net.ipv4.ip_local_port_range = 18000 65535 net.ipv4.tcp_max_syn_backlog = 65535 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_timestamps = 1 net.ipv4.tcp_no_metrics_save = 1 net.ipv4.tcp_moderate_rcvbuf = 1 [login to view URL] = 65535 net.core.netdev_max_backlog = 65535 # net.nf_conntrack_max = 500000 net.netfilter.nf_conntrack_max = 500000 net.netfilter.nf_conntrack_tcp_timeout_established = 900 net.netfilter.nf_conntrack_generic_timeout = 30 net.netfilter.nf_conntrack_tcp_timeout_close = 30 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 30 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 30 net.netfilter.nf_conntrack_tcp_timeout_last_ack = 30 net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 30 net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 30 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30 # net.ipv4.tcp_max_tw_buckets = 500000 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_rfc1337 = 1 net.ipv4.tcp_syn_retries = 1 net.ipv4.tcp_synack_retries = 1 # net.ipv4.tcp_slow_start_after_idle = 0 net.ipv4.tcp_fin_timeout = 30 net.ipv4.tcp_keepalive_time = 30 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 30 # net.core.rmem_max = 33554432 net.core.wmem_max = 33554432 net.ipv4.tcp_rmem = 10240 87380 33554432 net.ipv4.tcp_wmem = 10240 87380 33554432 Please dont offer if you are newbie of Nginx, i need professional experts. dont need those search google for nginx config. need professional advise. I need someone to solve this issue and help me configure nginx to work as reserve proxy and serve 1000 websites.
IČ projektu: 12725788

O projektu

7 nabídky
Vzdálený projekt
Aktivní před 7 roky

Chcete si vydělat nějaké peníze?

Výhody podávání nabídek na Freelancer

Stanovte si rozpočet a časový rámec
Získejte za svou práci zaplaceno
Načrtněte svůj návrh
Registrace a podávání nabídek je zdarma
Uděleno:
Avatar uživatele
Hello, thank you for inviting me to your project I currently work in a datacenter as a linux servers administrator, so i believe my skills are quite enough to solve your problem. any kind of linux work is my daily routine. I did same kind of projects before, please see my reviews to understand my knowledges level. As a member of "Preferred Freelancer" program, i can guarantee that your task will be complete in shortest time
$55 USD v 3 dnech
5,0 (95 recenze)
5,7
5,7
7 freelanceři nabízejí v průměru $142 USD za tuto práci
Avatar uživatele
Does your server have any control panel on board?. I'm lokoing forwards to your response. Thank you.
$110 USD v 1 dni
5,0 (131 recenze)
6,2
6,2
Avatar uživatele
Hi, I have 15 years of experience in Linux systems, worked with various flavours like CentOS, Ubuntu, Debian, Suse. I have extensive knowledge on Apache, Nginx, HAProxy, Varnish etc. I can work with you solve your issue and help you to achieve you what you want.
$250 USD v 3 dnech
5,0 (59 recenze)
6,0
6,0
Avatar uživatele
Hi, Can you provide me access to server so I can check logs?
$50 USD v 3 dnech
5,0 (108 recenze)
5,6
5,6

O klientovi

Pochází z UNITED KINGDOM
London, United Kingdom
5,0
5
Ověřená platební metoda
Členem od led 8, 2017

Ověření klienta

Díky! Poslali jsme vám e-mailem odkaz pro získání kreditu zdarma.
Při odesílání e-mailu se něco pokazilo. Zkuste to prosím znovu.
Registrovaných uživatelů Zveřejněných projektů
Freelancer ® is a registered Trademark of Freelancer Technology Pty Limited (ACN 142 189 759)
Copyright © 2024 Freelancer Technology Pty Limited (ACN 142 189 759)
Načítání náhledu
Bylo uděleno povolení ke geolokaci.
Vaše doba přihlášení vypršela a byli jste odhlášeni. Přihlaste se znovu.