Amazon EC2 Load Balancer: Defending against DoS attack?

amazon-ec2 amazon load-balancing iptables ddos
netvope picture netvope · Mar 7, 2010 · Viewed 10k times · Source

We usually blacklist IPs address with iptables. But in Amazon EC2, if a connection goes through the Elastic Load Balancer, the remote address will be replaced by the load balancer's address, rendering iptables useless. In the case for HTTP, apparently the only way to find out the real remote address is to look at the HTTP header HTTP_X_FORWARDED_FOR. To me, blocking IPs at the web application level is not an effective way.

What is the best practice to defend against DoS attack in this scenario?

In this article, someone suggested that we can replace Elastic Load Balancer with HAProxy. However, there are certain disadvantages in doing this, and I'm trying to see if there is any better alternatives.

Answer

sehugg picture sehugg · Apr 30, 2010

I think you have described all the current options. You may want to chime in on some of the AWS forum threads to vote for a solution - the Amazon engineers and management are open to suggestions for ELB improvements.

Related questions

Amazon EC2 Elastic Load Balancer: Does its IP ever Change?

Does the ELB's IP Ever Change once setup, or will it always access instances from the same location during its lifetime no matter what might be going on with it behind the scenes at Amazon?

Read More
Amazon EC2: Moving an EBS volume snapshot to s3

I am trying to create a backup and restore mechanism for my EBS volumes I could easily create a mechanism for this by using to take a snapshot of volume ec2-create-snapshot -d $description $volume and restore ec2-create-volume --snapshot $…

Read More
AWS EC2 Elastic IPs bandwidth usage and charges

I have a little questions regarding Elastic IPs and its charge. Some blogs says that Elastic IP will charge you by the bandwidth you use Elastic IP addresses charge by bandwidth and have an hourly price when they are not …

Read More