作为 load balancer, Happroxy 常常作为服务器的前端，向外界用户提供服务的入口，如果能在入口处处理安全相关问题，将极大简化后端的设计。事实上，Haproxy 不仅仅是一款开源出色的 load balancer（四层和七层），而且在安全上也相当出色。它配合内核 IP/TCP 协议栈，能够较好的抵抗 DOS, DDOS 攻击，还能通过限制单个 IP 的连接数和请求速率等，防止用户的恶意行为。
Haproxy 配置参数多的一塌糊涂，因而功能丰富，灵活多样，本文抛砖引玉，更多的安全功能请详见官网手册。
# Protection SYN flood net.ipv4.tcp_syncookies = 1 net.ipv4.conf.all.rp_filter = 1 net.ipv4.tcp_max_syn_backlog = 1024 sysctl -p
defaults option http-server-close mode http <span style="color:#ff0000;">timeout http-request 5s</span> # 防止 Slowloris like attacks timeout connect 5s timeout server 10s timeout client 30s listen stats bind 0.0.0.0:8880 stats enable stats hide-version stats uri / stats realm HAProxy\ Statistics stats auth admin:admin frontend ft_web bind 0.0.0.0:8080 default_backend bk_web backend bk_web balance roundrobin cookie MYSRV insert indirect nocache server srv1 192.168.1.2:80 check cookie srv1 maxconn 100 server srv2 192.168.1.3:80 check cookie srv2 maxconn 100
通过 telnet 登录验证结果
telnet 127.0.0.1 8080 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. HTTP/1.0 408 Request Time-out Cache-Control: no-cache Connection: close Content-Type: text/html <h1>408 Request Time-out</h1> Your browser didn't send a complete request in time. Connection closed by foreign host.
defaults option http-server-close mode http timeout http-request 5s timeout connect 5s timeout server 10s timeout client 30s listen stats bind 0.0.0.0:8880 stats enable stats hide-version stats uri / stats realm HAProxy\ Statistics stats auth admin:admin frontend ft_web bind 0.0.0.0:8080 <span style="color:#ff0000;"> # Table definition stick-table type ip size 100k expire 30s store conn_cur # Allow clean known IPs to bypass the filter tcp-request connection accept if { src -f /etc/haproxy/whitelist.lst } # Shut the new connection as long as the client has already 10 opened tcp-request connection reject if { src_conn_cur ge 10 } tcp-request connection track-sc1 src</span> default_backend bk_web backend bk_web balance roundrobin cookie MYSRV insert indirect nocache server srv1 192.168.1.2:80 check cookie srv1 maxconn 100 server srv2 192.168.1.3:80 check cookie srv2 maxconn 100注：若某些用户在同一个私有网段通过 NAT 访问网站，这样的配置存在不合理之处，最好把 NAT 处的公网地址添加到 whitelist.lst 文件中。
利用 apache 测试工具做验证，和服务器一直保持建立 10 个链接。
ab -n 50000000 -c 10 http://127.0.0.1:8080/用 telnet 打开第 11 个链接，服务器拒绝该链接。
telnet 127.0.0.1 8080 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Connection closed by foreign host.
仅仅限制单个用户的并发链接数并意味着万事大吉，如果用户在短时间内向服务器不断的发送建立和关闭链接请求，也会耗费服务器资源，影响服务器端的性能，因此需要控制单个用户的访问速率。
通常情况下，考虑到用户通过浏览器一般会建立 5-7 条 TCP 链接，我们可以认为普通用户在 3 秒内不应该建立超过 20 条链接。
defaults option http-server-close mode http timeout http-request 5s timeout connect 5s timeout server 10s timeout client 30s listen stats bind 0.0.0.0:8880 stats enable stats hide-version stats uri / stats realm HAProxy\ Statistics stats auth admin:admin frontend ft_web bind 0.0.0.0:8080 # Table definition stick-table type ip size 100k expire 30s store conn_cur,<span style="color:#ff0000;">conn_rate(3s)</span> # Allow clean known IPs to bypass the filter tcp-request connection accept if { src -f /etc/haproxy/whitelist.lst } # Shut the new connection as long as the client has already 10 opened or rate more than 20 tcp-request connection reject if { src_conn_cur ge 10 } <span style="color:#ff0000;">|| { src_conn_rate ge 20}</span> tcp-request connection track-sc1 src default_backend bk_web backend bk_web balance roundrobin cookie MYSRV insert indirect nocache server srv1 192.168.1.2:80 check cookie srv1 maxconn 100 server srv2 192.168.1.3:80 check cookie srv2 maxconn 100注：若某些用户在同一个私有网段通过 NAT 访问网站，这样的配置存在不合理之处，最好把 NAT 处的公网地址添加到 whitelist.lst 文件中。测试，采用 ab 打开 20 个链接。(本次测试把 限制单个用户并发数功能 去掉)
ab -n 20 -c 1 -r http://127.0.0.1:8080/再用 telnet 打开第 21 个链接，服务器拒绝该请求。telnet 127.0.0.1 8080 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Connection closed by foreign host.原文
Use a load-balancer as a first row of defense against DDOS
欢迎分享，我的微博：范小良gogogo原文地址：http://blog.csdn.net/wsfdl/article/details/42114855
