I managed to DDOS myself...
I noticed during my day yesterday that I couldn't upload an image to my xmpp server for the slidge whatsapp bridge. I figured I hadn't done that since updating so maybe something changed. So thought oh well, I'll look tonight.
Then as I'm leaving work, I get a call from one of the monsters children saying they can't use the internet as it's too slow and times out. I said to unplug the router and wait for 30 seconds then plug it back in. Apparently that solved the issue.
Except it didn't. Well, it did for a short while - presumably because my ISP handed out a new IP.
It seems the bots today decided to ramp up their hourly scraping sessions.
I couldn't even ping google
So I turned off my web server container to make sure that was where the traffic was originating (of course it was), then shut down individual websites via disabling their nginx conf to see which one was being hit - but that didn't really help me other than identify which one was being hit hard, so I killed nginx for a moment so I could access the web and search up how to block in nftables, then installed and ran iftop and watched for busy IPs... and there were a few. Then I added them to nftables as a blocklist to drop as they came in.
47.79.0.0/16, # Charter Communications
74.7.0.0/16, # Microsoft
162.159.0.0/16, # Cloudflare
8.219.0.0/16, # Alibaba Cloud
216.73.0.0/16, # Amazon
57.141.0.0/16, # Meta
151.101.0.0/16 # FastlyAmusingly, the one spoofing the browser useragents (which made no difference to iocaine) was originating from at least one of those IP, as it is now gone. 👌
a couple of humps as I added the busiest IPs (the ones above) to the drop list in nftables, then settles out at a lot less.
I realise this is a game of whack-a-mole, but it is interesting to witness. I will probably set up fail2ban and nginx to suit, and let them do the "rate-limiting" heh. I'll see how lazy I feel vs how bad this gets again I suppose.
24 hours later and iocaine graph looks like this. So still pretty good,
and I can ignore it and do something else until it's a problem again.
Isn't self hosting fun 😁