My server is under attack

[C.S. 99]

32 minutes ago, crusher11 said:

So you're saying that I should add those as a whitelist within Emby, as all connections from CloudFlare should come from one of those IP addresses? Because I had a look at the last successful remote connection to my server, which would have come through the domain, and it was from an IP that's not on that list.

I think it's worth a shot. I don't know but I'm guessing success will depend on the setting under Read proxy headers to determine client IP addresses.

Bottom line is you need something to make sure you're not responding to connection attempts from any addresses not on this list:

https://www.cloudflare.com/ips-v4/#

Whether your firewall, NGINX, or Emby itself, something needs to be doing that job.

[Neminem 1835]

Fully Qualified Domain Name

10 hours ago, crusher11 said:

FQDN?

 

[crusher11 1259]

13 hours ago, C.S. said:

I think it's worth a shot. I don't know but I'm guessing success will depend on the setting under Read proxy headers to determine client IP addresses.

It's currently set to “Yes,” though I don't know what that setting does or what it means.

 

4 hours ago, Neminem said:

Fully Qualified Domain Name

Does that mean anything distinct from just “domain name”?

[crusher11 1259]

18 hours ago, TMCsw said:

I' not sure if this works with CF:

but adding this to your nginx will block all requests not using your FQDN. 

server {
       listen ...
       ssl....

       ..stuif
             server_name emby.crusher11.com # using this won't get rejected  
       return 444;

 

This is the server block at present:

server {

    listen [::]:[port] ssl http2;	## Listens on port [port] IPv6 with http2 and ssl enabled
    listen [port] ssl http2;	## Listens on port [port] IPv4 with http2 and ssl enabled
    proxy_buffering off;        ## Sends data as fast as it can not buffering large chunks.

    server_name [my domain];    ## enter your service name and domain name here

    access_log  emby.log  emby;  ## Creates a log file with this name and the log info above.

     ## SSL SETTINGS ##
        ssl_session_timeout 30m;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
	ssl_certificate      /etc/nginx/cert.pem;  ## Location of your public PEM file.
	ssl_certificate_key  /etc/nginx/private.key;  ## Location of your private PEM file.
        ssl_session_cache shared:SSL:10m;

     location ^~ /swagger {   ## Disables access to swagger interface
        return 404;
}

So it already has the server name thing in there, but not the stuif bit. Not quite sure what to change?

There's also another server block that returns a 301 to an HTTP connection.

[C.S. 99]

31 minutes ago, crusher11 said:

It's currently set to “Yes,” though I don't know what that setting does or what it means.

Right so I think if you set that to No and whitelist the CF ip ranges, it should only respond to traffic coming from CF. The drawback is emby can't see the actual ip address of anyone connecting to you through CF. (But you could still track that info on CF's site.)

I should say I'm only suggesting this as a temporary solution until you get it figured out with NGINX or a firewall of some sort.