My server is under attack

[crusher11 1254]

No idea how they're getting to it, as it's a Hong Kong IP address and CloudFlare is blocking traffic from outside Australia. Three failed login attempts in the past ten minutes, one trying to log in as “root.” I see the alerts on my dashboard, but what I don't see is any way to block the offending IP? Not sure what autoban conditions exist, but since I'm on my server machine right now it seems silly to wait for it to kick in when I could just push a button. Is there no way to do that? And if it does get autobanned, I assume that's only for a period of time.

Not sure what other steps I should be taking here.

EDIT: I've disabled all remote connections for now, but it's obviously not the best solution.

EDIT 2: It's not a solution at all, it seems, as even with remote connections disabled I've just had another two failed login attempts, this time from Kansas City (the US is also on my CloudFlare whitelist, so that at least makes more sense than the Hong Kong efforts, though how it's connecting with all remote connections disallowed I don't know).

Edited 1 hour ago by crusher11

[Lessaj 543]

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

[crusher11 1254]

Just now, Lessaj said:

Sounds like you need to review your Cloudflare config or talk to them. Otherwise:

Not sure if you saw my second edit, as you posted only a few seconds after I made it.

Which settings page is this screenshot from?

[Lessaj 543]

I did not. That's on the Network page.

[crusher11 1254]

Ah, right, I couldn't see it because it disappears if you disable all remote connections.

There really ought to be a way to add an address directly to that list from the “failed login attempt” alert.

Still no idea how they bypassed the CloudFlare block, or how they connected when all remote connections were disabled in Emby, or why I've suddenly had a bunch of attacks come in.

[Lessaj 543]

Based on my understanding the option for allow remote connections doesn't prevent the connection entirely, it just prevents logins. If the port is open, then it's open. You'd have to close the port/Cloudflare tunnel to fully disable remote connections. I can't test on my system at the moment to confirm that.

[RanmaCanada 573]

If you're only Cloudflare, does it not have an option to whiltelist traffic, and block everything else? I honestly do not know as I do not use it.

apparently there is. https://developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/