My server is under attack

[C.S. 99]

32 minutes ago, crusher11 said:

So you're saying that I should add those as a whitelist within Emby, as all connections from CloudFlare should come from one of those IP addresses? Because I had a look at the last successful remote connection to my server, which would have come through the domain, and it was from an IP that's not on that list.

I think it's worth a shot. I don't know but I'm guessing success will depend on the setting under Read proxy headers to determine client IP addresses.

Bottom line is you need something to make sure you're not responding to connection attempts from any addresses not on this list:

https://www.cloudflare.com/ips-v4/#

Whether your firewall, NGINX, or Emby itself, something needs to be doing that job.

[Neminem 1840]

Fully Qualified Domain Name

10 hours ago, crusher11 said:

FQDN?

 

[crusher11 1260]

13 hours ago, C.S. said:

I think it's worth a shot. I don't know but I'm guessing success will depend on the setting under Read proxy headers to determine client IP addresses.

It's currently set to “Yes,” though I don't know what that setting does or what it means.

 

4 hours ago, Neminem said:

Fully Qualified Domain Name

Does that mean anything distinct from just “domain name”?

[crusher11 1260]

18 hours ago, TMCsw said:

I' not sure if this works with CF:

but adding this to your nginx will block all requests not using your FQDN. 

server {
       listen ...
       ssl....

       ..stuif
             server_name emby.crusher11.com # using this won't get rejected  
       return 444;

 

This is the server block at present:

server {

    listen [::]:[port] ssl http2;	## Listens on port [port] IPv6 with http2 and ssl enabled
    listen [port] ssl http2;	## Listens on port [port] IPv4 with http2 and ssl enabled
    proxy_buffering off;        ## Sends data as fast as it can not buffering large chunks.

    server_name [my domain];    ## enter your service name and domain name here

    access_log  emby.log  emby;  ## Creates a log file with this name and the log info above.

     ## SSL SETTINGS ##
        ssl_session_timeout 30m;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
	ssl_certificate      /etc/nginx/cert.pem;  ## Location of your public PEM file.
	ssl_certificate_key  /etc/nginx/private.key;  ## Location of your private PEM file.
        ssl_session_cache shared:SSL:10m;

     location ^~ /swagger {   ## Disables access to swagger interface
        return 404;
}

So it already has the server name thing in there, but not the stuif bit. Not quite sure what to change?

There's also another server block that returns a 301 to an HTTP connection.

[C.S. 99]

31 minutes ago, crusher11 said:

It's currently set to “Yes,” though I don't know what that setting does or what it means.

Right so I think if you set that to No and whitelist the CF ip ranges, it should only respond to traffic coming from CF. The drawback is emby can't see the actual ip address of anyone connecting to you through CF. (But you could still track that info on CF's site.)

I should say I'm only suggesting this as a temporary solution until you get it figured out with NGINX or a firewall of some sort.

[pwhodges 2083]

2 hours ago, crusher11 said:

 

Does that mean anything distinct from just “domain name”?

It means the whole name; there are situations when part of the name may be assumed.

Paul

[TMCsw 290]

So i'm switching my DDNS to Cloudflare DNS but it will take some to make a how to:

6 hours ago, crusher11 said:

server_name [my domain];    ## enter your service name and domain name here

# add this: after

  return 444;

444 = drop connection with nginx.

if your users can't connect, then remove it

Edited 13 hours ago by TMCsw

[Normanos 16]

One more thing, to outside from home network. Did You changed external default port?

 I using non standard port for Emby as crackers trying usually standard ports.

In my setup, Emby -> Opnsense NGINX Reverse Proxy different port and specific domain name.   No Cloudflare (had playback issues).

Also, not sure, of course, but I not using word Emby in domain name.

 Opnsense also have Geoblock. Using Emby around 5 years, never had problems. 

Edited 12 hours ago by Normanos

[pwhodges 2083]

11 hours ago, crusher11 said:

ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

You absolutely should not be enabling TLSv1.0, and TLSv1.1 has also been deprecated for quite some years now.  TLSv1.2 is now 18 years old. but still in common use, and you should also enable the 8yo TLSv1.3

Paul

[crusher11 1260]

6 hours ago, pwhodges said:

You absolutely should not be enabling TLSv1.0, and TLSv1.1 has also been deprecated for quite some years now.  TLSv1.2 is now 18 years old. but still in common use, and you should also enable the 8yo TLSv1.3

Paul

I recall there being some sort of compatibility issue between certain versions of TLS and of NGINX?

[pwhodges 2083]

Very unlikely!

Paul