Squid as Reverse proxy in front of actual BJP.org Site running of Apache

Situation

BJP.org had IP based DDOS attack

Temp Solution

Build a reverse proxy in rackspace data center use the local eth1 both server .
Point the DNS to the global IP of Squid server acting at reverse proxy

Referance

http://wiki.squid-cache.org/ConfigExamples/Reverse/BasicAccelerator

Servers

Squid Server - 166.78.63.21 (Global) , 10.182.26.87 (local)

Apache Server - 198.61.199.121 ( global / made down), 10.178.107.106 (local)

Implementation

On Squid Reverse Proxy

yum install squid

mv /etc/squid/squid.conf /etc/squid/squid.conf.org

create a new /etc/squid/squid.conf

##Squid as Reverse Proxy
http_port 80 accel defaultsite=www.bjp.org
cache_peer 10.178.107.106  parent 80 0 no-query originserver name=myAccel forceddomain=www.bjp.org
acl our_sites dstdomain www.bjp.org
http_access allow our_sites
http_access deny all
cache_peer_access myAccel allow our_sites
cache_peer_access myAccel deny all
never_direct allow all

10.178.107.106 - Local IP of old server (198.61.199.121)

Add 10.178.107.106 in /etc/hosts as

10.178.107.106     bjp.org      www.bjp.org

Changes on Apache Server ( BJP.org )

Apache server's file

NameVirtualHosts 10.178.107.106:80
<VirtualHost 10.178.107.106:80>
   ServerAdmin webmaster@dummy-host.bjp.org
   DocumentRoot /var/www/html/cms12
#    DocumentRoot /var/www/html/maintenance
   ServerName bjp.org
<Directory /var/www/html/cms12>
   Options Indexes FollowSymLinks MultiViews +ExecCGI
   AllowOverride AuthConfig FileInfo
   Order deny,allow
   Deny from all
   allow from 127.0.0.1
   allow from 10.182.26.87
</Directory>
Alias /tetra-cp /var/www/html/cms12/tetra-cp
   ErrorLog logs/bjp-org-err.log
   CustomLog logs/bjp-org-access.log common

The old file of httpd.conf has been save with date

Once Activated on Squid server with

service squid start
chkconfig squid on

The logs are analyzed for few hours so that there is no futher attack

Few issues Faced and there resolutions

The site was failing and showing 403 Errors on both logs of Squid and Apache .

We realized that as mod_evasive was implemented earlier on the apache as DOS attack prevention mechanism . This mechanism was causing this error as only IP of squid was accessing the Apache server .

So mod_evasive was by passed by moving or renaming the file out of /etc/httpd/conf.d of Apache Server .

This has fixed the issue of 403 errors .

Conclustion

We can build more servers on the fly to protect .
As the Apache is directly not projected there are less security threats .

Protecting BJP's Joomla Control Panel URL restricted to IPs of Tetra and BJP

Modify the Squid.conf as shown highlighted below

http_port 80 accel defaultsite=www.bjp.org
cache_peer 10.178.107.106  parent 80 0 no-query originserver name=myAccel forceddomain=www.bjp.org
acl our_sites dstdomain www.bjp.org
acl allowed_ip src "/etc/squid/allowed_ip"
acl blockregexurl url_regex -i administrator
http_access allow allowed_ip blockregexurl
http_access deny blockregexurl
http_access allow our_sites
http_access deny all
cache_peer_access myAccel allow our_sites
cache_peer_access myAccel deny all
never_direct allow all

And the IPs are in /etc/squid/allowed_ip

59.144.174.135
122.160.21.105
203.122.13.226
122.184.144.66
122.184.144.82
124.247.243.4

Client End Configuration for Admin access of BJP.ORG

This change is required as actual BJP.ORG is accessible via Proxy Server and BJP.ORG is pointing Cloudflare's ( CDN Network ) IP . This is required due to complected architecture of site

On Linux Open /etc/hosts and add

192.237.210.79  www.bjp.org     bjp.org

On Windows Open c:/windows/system32/drivers/hosts or c:/windows/system32/hosts and ADD

192.237.210.79  www.bjp.org     bjp.org