My server is under DoS attack

The server’s load is high due to a denial-of-service attack.
In DoS attacks, multiple connections are established from an IP address, and BitNinja will block the IP address if the number of connections reaches our threshold.

BitNinja blocks most of the infected server’s IP addresses via the challenge list or the block list, so most malicious attacks are already blocked.

Fine-tune the DoS module threshold

1. Lower the DoS protection threshold value in the /etc/bitninja/DosDetection/config.ini file, thus eliminating most of the danger.
2. Go to /etc/bitninja/DosDetection/config.ini
3. Under the [thresholds] flag, you can see the service name and the current threshold enabled.
   
4. The default threshold for ports 80 HTTP and 443 HTTPS is 80 connections per IP address. If the attack is coming via HTTP or HTTPS, then you will need to add the two lines below to the config.
   local[80] = <limit here>
local[443] = <limit here>
5. Save your changes.
6. Synchronize the configuration changes with our cloud using the command:
   bitninjacli --syncconfigs
7. Reload the module with bitninjacli --module=DosDetection --reload command
8. Monitor the module logs for detected attacks:
   tail -f /var/log/bitninja/mod.dos_detection.log

If the WAF module is enabled, the attackers connect via ports 60300 and 60301 due to the module redirections created on ports 80 and 443.
In these ports’ cases, the DosDetection module’s default threshold is 200.
So the below lines need to be added to the config file:
local[60300] = <limit here>
local[60301] = <limit here>

Block IP manually

You can block IP addresses manually by challenge listing them or block listing them from the Dashboard.

• Go to the Firewall -> Block list menu, and add the IP addresses to your block list, or use
  bitninjacli --blacklist --add=<IP address>
• Insert the IP into the search field and click on the “+ challenge list” button, or use
  bitninjacli --greylist --add=<IP address>