My server is under attack

[C.S. 100]

32 minutes ago, crusher11 said:

So you're saying that I should add those as a whitelist within Emby, as all connections from CloudFlare should come from one of those IP addresses? Because I had a look at the last successful remote connection to my server, which would have come through the domain, and it was from an IP that's not on that list.

I think it's worth a shot. I don't know but I'm guessing success will depend on the setting under Read proxy headers to determine client IP addresses.

Bottom line is you need something to make sure you're not responding to connection attempts from any addresses not on this list:

https://www.cloudflare.com/ips-v4/#

Whether your firewall, NGINX, or Emby itself, something needs to be doing that job.

[Neminem 1873]

Fully Qualified Domain Name

10 hours ago, crusher11 said:

FQDN?

 

[crusher11 1278]

13 hours ago, C.S. said:

I think it's worth a shot. I don't know but I'm guessing success will depend on the setting under Read proxy headers to determine client IP addresses.

It's currently set to “Yes,” though I don't know what that setting does or what it means.

 

4 hours ago, Neminem said:

Fully Qualified Domain Name

Does that mean anything distinct from just “domain name”?

[crusher11 1278]

18 hours ago, TMCsw said:

I' not sure if this works with CF:

but adding this to your nginx will block all requests not using your FQDN. 

server {
       listen ...
       ssl....

       ..stuif
             server_name emby.crusher11.com # using this won't get rejected  
       return 444;

 

This is the server block at present:

server {

    listen [::]:[port] ssl http2;	## Listens on port [port] IPv6 with http2 and ssl enabled
    listen [port] ssl http2;	## Listens on port [port] IPv4 with http2 and ssl enabled
    proxy_buffering off;        ## Sends data as fast as it can not buffering large chunks.

    server_name [my domain];    ## enter your service name and domain name here

    access_log  emby.log  emby;  ## Creates a log file with this name and the log info above.

     ## SSL SETTINGS ##
        ssl_session_timeout 30m;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
	ssl_certificate      /etc/nginx/cert.pem;  ## Location of your public PEM file.
	ssl_certificate_key  /etc/nginx/private.key;  ## Location of your private PEM file.
        ssl_session_cache shared:SSL:10m;

     location ^~ /swagger {   ## Disables access to swagger interface
        return 404;
}

So it already has the server name thing in there, but not the stuif bit. Not quite sure what to change?

There's also another server block that returns a 301 to an HTTP connection.

[C.S. 100]

31 minutes ago, crusher11 said:

It's currently set to “Yes,” though I don't know what that setting does or what it means.

Right so I think if you set that to No and whitelist the CF ip ranges, it should only respond to traffic coming from CF. The drawback is emby can't see the actual ip address of anyone connecting to you through CF. (But you could still track that info on CF's site.)

I should say I'm only suggesting this as a temporary solution until you get it figured out with NGINX or a firewall of some sort.

[pwhodges 2093]

2 hours ago, crusher11 said:

 

Does that mean anything distinct from just “domain name”?

It means the whole name; there are situations when part of the name may be assumed.

Paul

[TMCsw 299]

So i'm switching my DDNS to Cloudflare DNS but it will take some to make a how to:

6 hours ago, crusher11 said:

server_name [my domain];    ## enter your service name and domain name here

# add this: after

  return 444;

444 = drop connection with nginx.

if your users can't connect, then remove it

Edited August 18 by TMCsw

[Normanos 17]

One more thing, to outside from home network. Did You changed external default port?

 I using non standard port for Emby as crackers trying usually standard ports.

In my setup, Emby -> Opnsense NGINX Reverse Proxy different port and specific domain name.   No Cloudflare (had playback issues).

Also, not sure, of course, but I not using word Emby in domain name.

 Opnsense also have Geoblock. Using Emby around 5 years, never had problems. 

Edited August 18 by Normanos

[pwhodges 2093]

11 hours ago, crusher11 said:

ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

You absolutely should not be enabling TLSv1.0, and TLSv1.1 has also been deprecated for quite some years now.  TLSv1.2 is now 18 years old. but still in common use, and you should also enable the 8yo TLSv1.3

Paul

[crusher11 1278]

6 hours ago, pwhodges said:

You absolutely should not be enabling TLSv1.0, and TLSv1.1 has also been deprecated for quite some years now.  TLSv1.2 is now 18 years old. but still in common use, and you should also enable the 8yo TLSv1.3

Paul

I recall there being some sort of compatibility issue between certain versions of TLS and of NGINX?

[pwhodges 2093]

Very unlikely!

Paul

[Neminem 1873]

2 hours ago, crusher11 said:

I recall there being some sort of compatibility issue between certain versions of TLS and of NGINX?

I guess, if you have NOT updated NGINX, but that it self is a security issue

[crusher11 1278]

I'm running it in docker and frankly have no idea how updates work there...

[Neminem 1873]

Ohhhh wow and you ask Emby and us what is going on......

And you do not know what you are doing....

Server management is not set and forget, if you open up your router / firewall.

Where did you loose you pacifier ?

how to docker - Søg

Docker 101 Tutorial | Docker

Docker Tutorial - GeeksforGeeks

[pwhodges 2093]

5 minutes ago, crusher11 said:

I'm running it in docker and frankly have no idea how updates work there...

Then find out...

When you say things like that, I wonder how you managed to set up a non-trivial system using docker, nginx, and Cloudflare in the first place.

Paul

[crusher11 1278]

Just now, pwhodges said:

When you say things like that, I wonder how you managed to set up a non-trivial system using docker, nginx, and Cloudflare in the first place.

Following guides I read years ago and have since forgotten.

The docker image is nginx:latest, but I don't know if that means just the latest at the time I created the container or if it's updating itself when needed.

I was running calibre out of a docker container some time back, then needed to update for a specific feature and was told updating was impossible, I could only delete it (losing all my data) and recreate it. Which seems wrong, but the path of least friction in that case was just recreating my library on my Windows PC. Since Emby is running on my Synology NAS, that's not an option here.

[Neminem 1873]

19 minutes ago, crusher11 said:

Following guides I read years ago and have since forgotten.

I guess you need to look at the links in my post above.

Or not port forward.

Any server is as secure as the admin ( You ).....

One guide can change or be faulty in many ways, some are easy, others hard.

But you need to use your brain and learn if you want to NOT get in this situation....

[crusher11 1278]

On 8/18/2026 at 11:07 AM, TMCsw said:

So i'm switching my DDNS to Cloudflare DNS but it will take some to make a how to:

# add this: after

  return 444;

444 = drop connection with nginx.

if your users can't connect, then remove it

Wouldn't that drop all connections, whether they come through the domain or the IP?

[C.S. 100]

So... is your server still under attack?

[crusher11 1278]

There have been no attempted intrusions since that hour or so the other day. But I'd still like to make sure all traffic is going through CloudFlare, because that's a bit of a security hole.