首先在http 这里做一个门防御
frontend http
bind 10.0.0.20:80
acl anti_ddos always_true
#白名单
acl whiteip src -f /usr/local/haproxy/etc/whiteip.lst
#标记非法用户
stick-table type ip size 20k expire 2m store gpc0
tcp-request connection track-sc1 src
tcp-request inspect-delay 5s
#拒绝非法用户建立连接
tcp-request connection reject if anti_ddos { src_get_gpc0 gt 0 }
然后在具体网站模块那再做个防御门
backend xxx.xxx.cn
mode http
option forwardfor
option httplog
balance roundrobin
cookie SERVERID insert indirect
option httpchk GET /KeepAlive.ashx HTTP/1.1\r\nHost:\ server.1card1.cn
acl anti_ddos always_false
#白名单
acl whiteip src -f /usr/local/haproxy/etc/whiteip.lst
#存储client10秒内的会话速率
stick-table type ip size 20k expire 2m store http_req_rate(10s),bytes_out_rate(10s)
tcp-request content track-sc2 src
#十秒内会话速率超过50个则可疑
acl conn_rate_limit src_http_req_rate(server.1card1.cn) gt 80
#判断http请求中是否存在SERVERID的cookie
acl cookie_present cook(SERVERID) -m found
#标记为非法用户
acl mark_as_abuser sc1_inc_gpc0 gt 0
tcp-request content reject if anti_ddos !whiteip conn_rate_limit mark_as_abuser