Cocky Proxy

A reverse proxy is mainly used by administrators and is responsible for balancing workload and high availability. The reverse proxy redirects received requests to one of its web servers. From the outside it is completely invisible and looks as if all required resources are concentrated directly in the proxy.

The proxy domain most often refers to the IP address where the server is located. It can only "learn" the IP address of the user when processing the traffic. But in most cases it does not store such information later for security reasons.

There are HTTP proxy, FTP proxy, SOCKS proxy, SMTP proxy, CGI proxy. They differ only in the data transmission protocol used and the purpose for which they are used. For example, SMTP proxy allows you to organize a secure server for e-mail.

Fail2Ban is a security tool that analyzes log files for malicious patterns and bans IP addresses that show suspicious activity. Although Fail2Ban is primarily designed to work with TCP-based protocols like SSH, HTTP, and MySQL, it can be configured to work with UDP-based protocols, including UDP flood attacks.

To use Fail2Ban to protect your server from UDP flood attacks, follow these steps:

1. Install Fail2Ban:

sudo apt-get update
sudo apt-get install fail2ban

2. Create a custom UDP log file:

Create a log file to store the UDP flood attack data. This log file should be located in the /var/log/ directory, and it should have the appropriate permissions. For example, you can create a log file named udp-flood.log:

sudo touch /var/log/udp-flood.log
sudo chown syslog:adm /var/log/udp-flood.log
sudo chmod 640 /var/log/udp-flood.log

3. Configure Fail2Ban to monitor the UDP log file:

Create a new filter file for UDP flood attacks, for example, /etc/fail2ban/filter.d/udp-flood.conf:

[Definition]
failregex = ^.*UDP.*Flood.*
ignoreregex =

Replace HOST with the actual hostname or IP address of your server, and with the IP address of the attacking host.

Next, create a new action file for UDP flood attacks, for example, /etc/fail2ban/action.d/udp-flood.conf:

[Definition]
actionstart =
actionstop =
actioncheck =
actionban = iptables -I INPUT -s  -j DROP; iptables-save
actionunban = iptables -D INPUT -s  -j DROP; iptables-save

Replace IP with the IP address of the banned host.

Finally, create a new jail configuration file for UDP flood attacks, for example, /etc/fail2ban/jail.d/udp-flood.local.conf:

[udp-flood]
enabled = true
port = 
logpath = /var/log/udp-flood.log
maxretry = 3
findtime = 300
bantime = 1800
action = udp-flood

Replace UDP_PORT with the UDP port you want to monitor.

Reload Fail2Ban configuration:

sudo systemctl reload fail2ban

A proxy server is a kind of "mediator" between your equipment and a remote server (or the whole Internet). It can be used, for example, to swap your real IP address for another one, to bypass blocking. Proxies can also be actively used to intercept traffic (e.g. when testing created web applications).