Squid as Reverse proxy in front of actual BJP.org Site running of Apache

Situation

BJP.org had IP based DDOS attack

Temp Solution

Build a reverse proxy in rackspace data center use the local eth1 both server .
Point the DNS to the global IP of Squid server acting at reverse proxy

Referance

http://wiki.squid-cache.org/ConfigExamples/Reverse/BasicAccelerator

Servers

Squid Server - 50.56.177.99 (Global) , 10.180.38.116 (local)

Apache Server - 198.61.199.121 ( global / made down), 10.178.107.106 (local)

Implementation

On Squid Reverse Proxy

yum install squid

mv /etc/squid/squid.conf /etc/squid/squid.conf.org

create a new /etc/squid/squid.conf

##Squid as Reverse Proxy
http_port 80 accel defaultsite=www.bjp.org
cache_peer 10.178.107.106  parent 80 0 no-query originserver name=myAccel forceddomain=www.bjp.org
acl our_sites dstdomain www.bjp.org
http_access allow our_sites
http_access deny all
cache_peer_access myAccel allow our_sites
cache_peer_access myAccel deny all
never_direct allow all

10.178.107.106 - Local IP of old server (198.61.199.121)

Changes on Apache Server ( BJP.org )

Apache server's file

NameVirtualHosts 10.178.107.106:80
<VirtualHost 10.178.107.106:80>
   ServerAdmin webmaster@dummy-host.bjp.org
   DocumentRoot /var/www/html/cms12
#    DocumentRoot /var/www/html/maintenance
   ServerName bjp.org
<Directory /var/www/html/cms12>
   Options Indexes FollowSymLinks MultiViews +ExecCGI
   AllowOverride AuthConfig FileInfo
   Order deny,allow
   Deny from all
   allow from 127.0.0.1
   allow from 10.180.38.116
</Directory>
Alias /tetra-cp /var/www/html/cms12/tetra-cp
   ErrorLog logs/bjp-org-err.log
   CustomLog logs/bjp-org-access.log common

The old file of httpd.conf has been save with date

Once Activated on Squid server with

service squid start
chkconfig squid on

The logs are analyzed for few hours so that there is no futher attack

Few issues Faced and there resolutions

The site was failing and showing 403 Errors on both logs of Squid and Apache .

We realized that as mod_evasive was implemented earlier on the apache as DOS attack prevention mechanism . This mechanism was causing this error as only IP of squid was accessing the Apache server .

So mod_evasive was by passed by moving or renaming the file out of /etc/httpd/conf.d of Apache Server .

This has fixed the issue of 403 errors .

Conclustion

We can build more servers on the fly to protect .
As the Apache is directly not projected there are less security threats .