My server is under attack

[crusher11 1278]

No idea how they're getting to it, as it's a Hong Kong IP address and CloudFlare is blocking traffic from outside Australia. Three failed login attempts in the past ten minutes, one trying to log in as “root.” I see the alerts on my dashboard, but what I don't see is any way to block the offending IP? Not sure what autoban conditions exist, but since I'm on my server machine right now it seems silly to wait for it to kick in when I could just push a button. Is there no way to do that? And if it does get autobanned, I assume that's only for a period of time.

Not sure what other steps I should be taking here.

EDIT: I've disabled all remote connections for now, but it's obviously not the best solution.

EDIT 2: It's not a solution at all, it seems, as even with remote connections disabled I've just had another two failed login attempts, this time from Kansas City (the US is also on my CloudFlare whitelist, so that at least makes more sense than the Hong Kong efforts, though how it's connecting with all remote connections disallowed I don't know).

Edited August 13 by crusher11

[Lessaj 561]

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

[crusher11 1278]

Just now, Lessaj said:

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

Not sure if you saw my second edit, as you posted only a few seconds after I made it.

Which settings page is this screenshot from?

[Lessaj 561]

I did not. That's on the Network page.

[crusher11 1278]

Ah, right, I couldn't see it because it disappears if you disable all remote connections.

There really ought to be a way to add an address directly to that list from the “failed login attempt” alert.

Still no idea how they bypassed the CloudFlare block, or how they connected when all remote connections were disabled in Emby, or why I've suddenly had a bunch of attacks come in.

[Lessaj 561]

Based on my understanding the option for allow remote connections doesn't prevent the connection entirely, it just prevents logins. If the port is open, then it's open. You'd have to close the port/Cloudflare tunnel to fully disable remote connections. I can't test on my system at the moment to confirm that.

[RanmaCanada 586]

If you're only Cloudflare, does it not have an option to whiltelist traffic, and block everything else? I honestly do not know as I do not use it.

apparently there is. https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/

[pwhodges 2093]

Do you not have a firewall in your own equipment?

Paul

[crusher11 1278]

7 hours ago, pwhodges said:

Do you not have a firewall in your own equipment?

I would assume so? I'm not sure which equipment would be involved here; my NAS isn't on the internet directly as far as I know.

[pwhodges 2093]

I have no experience of NASes, but I would assume that they would have at least some firewall capabilities available, as virtually all operating systems do.  In my case, my main firewall is in my router - but that is of a type aimed at SMEs rather than domestic use (the simpler domestic routers may simply rely on IPv4 NAT for security, though that's not good enough if you have IPv6).

Paul

[crusher11 1278]

I have all the online functionality of my NAS's operating system disabled, so I'm not sure how it all works. Would the NAS firewall see anyone connecting to Emby?

And regardless, how does it impact this specific situation?

[TMCsw 299]

Do you have a port open on your router, either manually or by allowing UPnP? If so, anyone(hackers) can directly hit your LAN, without going thru CF.

[crusher11 1278]

You have to have a port open for the domain to work, no?

[Neminem 1873]

Hmm so you just port forward to Emby via your router?

If the above is correct then this is correct.

20 hours ago, TMCsw said:

If so, anyone(hackers) can directly hit your LAN, without going thru CF.

Have you setup fail2ban or other have a prober firewall?

I use a local firewall and have geo blocking inplace.

You wont believe how many bots / script kiddies / other that hit my firewall everyday.

Edited August 16 by Neminem

[crusher11 1278]

Just now, Neminem said:

Hmm so you just port forward to Emby via your router?

It's been a long time since I set it up so I've forgotten a lot of the config, but I have NGINX involved somewhere. I'm not sure where the ports forward to, that always confused me a bit TBH.

1 minute ago, Neminem said:

Have you setup fail2ban or other have a prober firewall?

My understanding is Emby now implements IP blocking after a certain number of failed attempts. I think I had fail2ban set up when I was running the server on my Windows machine but could never figure out how to set up something like that on Synology, then once Emby implemented it anyway I forgot about it.

[Neminem 1873]

CF should not be you only security.

6 minutes ago, crusher11 said:

My understanding is Emby now implements IP blocking after a certain number of failed attempts.

That might not be tight enough.

Hence your own firewall that can take the blows.

[crusher11 1278]

Just now, Neminem said:

CF should not be you only security.

That might not be tight enough.

Hence your own firewall that can take the blows.

As I said to @pwhodges, is the Synology OS going to see attacks on Emby?

Is there a way to block direct connections to my IP? I was under the impression that the CF/NGINX setup I followed was supposed to do that.

[Neminem 1873]

4 minutes ago, crusher11 said:

Is there a way to block direct connections to my IP? I was under the impression that the CF/NGINX setup I followed was supposed to do that.

Yes, turn of port forwarding.

But then you can't do remote sessions.

Unless you setup a VPN or the like.

[crusher11 1278]

Right, I want the domain to still work, obviously.

[Neminem 1873]

Then you need a firewall to block, who you don't want to have access.

If they are going in directly to your ip then CF can't help you.

[C.S. 100]

https://www.cloudflare.com/ips-v4/#

You could try using your remote ip filter as a whitelist with these addresses. 

[RanmaCanada 586]

5 hours ago, C.S. said:

https://www.cloudflare.com/ips-v4/#

You could try using your remote ip filter as a whitelist with these addresses. 

I suggested that, but they absolutely do not seem interested in using the tools available to them.

[C.S. 100]

I think you were suggesting they create a whitlelist through the CF firewall rules. That works to filter anyone connecting to the domain, but it seems like OP is concerned with direct connections to his open port.

Putting the actual CF networks into a whitelist on the server itself should block all direct connections, right? Everything must go through CF.

[TMCsw 299]

I' not sure if this works with CF:

but adding this to your nginx will block all requests not using your FQDN. 

server {
       listen ...
       ssl....

       ..stuif
             server_name emby.crusher11.com # using this won't get rejected  
       return 444;

 

[crusher11 1278]

On 8/14/2026 at 3:50 AM, RanmaCanada said:

If you're only Cloudflare, does it not have an option to whiltelist traffic, and block everything else? I honestly do not know as I do not use it.

apparently there is. https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/

I somehow missed this post. The fact that the attack came from an IP that should have been blocked given my CloudFlare config means it's bypassing CloudFlare's protection, so shifting to a whitelist means added hassle for little benefit.

 

10 hours ago, C.S. said:

https://www.cloudflare.com/ips-v4/#

You could try using your remote ip filter as a whitelist with these addresses. 

4 hours ago, C.S. said:

I think you were suggesting they create a whitlelist through the CF firewall rules. That works to filter anyone connecting to the domain, but it seems like OP is concerned with direct connections to his open port.

Putting the actual CF networks into a whitelist on the server itself should block all direct connections, right? Everything must go through CF.

So you're saying that I should add those as a whitelist within Emby, as all connections from CloudFlare should come from one of those IP addresses? Because I had a look at the last successful remote connection to my server, which would have come through the domain, and it was from an IP that's not on that list.

 

3 hours ago, TMCsw said:

I' not sure if this works with CF:

but adding this to your nginx will block all requests not using your FQDN. 

server {
       listen ...
       ssl....

       ..stuif
             server_name emby.crusher11.com # using this won't get rejected  
       return 444;

 

FQDN?