Nginx-Lua-Anti-DDoS - A Anti-DDoS script to protect Nginx web servers us

项目说明

![Languages !Top language !File size]() ![Build and Publish RPM/DEB Packages]()

![Cloudflare I am Under Attack Mode!]()

Master Branch for Modern Nginx Lua Builds - Old Outdated Nginx Lua Builds use this branch

Nginx-Lua-Anti-DDoS

A Anti-DDoS script to protect Nginx web servers using Lua with a Ja based authentication puzzle inspired by Cloudflare I am under attack mode I built my own Anti-DDoS authentication HTML page puzzle intergrating my Lua, Ja, HTML and HTTP knowledge.

Mitigate a DDoS attack of any size using my free DDoS protection. Don't get ddos attacked!

If you're under attack and use my script during the attack, will receive an interstitial page for about fi while I analyze the traffic to make sure it is a legitimate human .

This can protect you from many different forms of DDoS works with both HTTP and HTTPS / SSL traffic.

No limit on attack size
Uptime guarantee

100% asynchronous nonblocking I/O

Features :

These are some of the features I built into the script so far.

Security

Limit IP requests / Flooding

Ability to use Remote servers for Anti-DDoS data/key storage

Ability to use redis cache 服务端 for anti-ddos protection

Ability to use memcached 服务端 for anti-ddos protection

Automatically turn on Under Attack mode if DDoS detected

I am Under Attack Mode (DDoS Authentication HTML Page)

IP Address Whitelist

IP Subnet Ranges Whitelist

IP Address Blacklist

IP Subnet Ranges Blacklist

User-Agent Whitelist

User-Agent Blacklist

Protected area / Restricted access field username / password box to restrict access to sites / paths.

Enable or disable logging of users who either fail or succeed solving the authentication puzzle. (Fail2Ban users can use this to ban bots AI tools and IP addresses from the log file)

Range header filtering Most download / Video streaming sites and services use range headers this allows you to filter and block slowhttp / slowloris attack types

Remote storage encryption to protect sensative data stored on redis memcached etc

Storage compression on stored data to save disk/storage space/memory compression options of LuaLZW, Brotli, Zstd, Zlib, GZip, Google Snappy

WAF (Web Application Firewall)

IPv4 and IPv6 blocking and whitelisting including subnet ranges.

User-Agent blocking and whitelisting to block bad bots and exploits / scanners.

Ability to inspect POST Data / Fields and block malicious POST requests / exploits.

Ability to inspect URL for malicious content SQL/SQI Injections XSS attacks / exploits.

Ability to inspect query strings and arguements for malicious content / exploits.

Ability to inspect all Request Headers provided by the 客户端 connecting.

Ability to inspect cookies for exploits.

Caching Speed and Performance

Webpage Caching Ability/Feature to Cache webpages and Bypass Cache based on cookies or URL's

Webpage Caching Ability/Feature to Cache only when Cookies or URL's exist

Webpage Caching Ability/Feature to Cache only if page size is Larger than or Smaller than a certain size

Query String Sorting

Query String Whitelist

Query String Removal (It is a blacklist but it will just drop / remove the argument from the URL not block the request)

Minification / Compression of files removing white space and nulled out 代码 / lines JS Ja, CSS Stylesheets, HTML etc

Ability to use Redis as a cache storage soloution

Ability to use Memcached as a cache storage soloution

Ability to use lrucache as a cache storage soloution

Ability to use shared.DICT memory as a cache storage soloution

Ability to encrypt stored data to protect from hosting hacks and information stealing / snooping

Ability to compress stored data to save disk/storage space/memory compression methods include LZW (LUALZW) ZSTD Zstandard, Brotli, Zlib, GZip, Google Snappy to sa in cached storage space and reduced costs.

Support for Additional services

Supports Tor services .Tor

Supports Lokinet services .Loki

Supports Ethereum name services .ENS

Supports The in internet project .i2p

Supports Freenet

Supports IPFS inter planetary file system

Supports IPNS inter planetary name system

Supports SWARM network

Supports Radicale

Supports any port matches node or hidden service that nginx is protecting

Supports zeronet

Customization of error pages responses and webpage outputs

Custom error page interception to replace with your own error pages

Hide Web application errors such as PHP errorrs MySQL errors it will intercept them and display a custom error page instead of showing sensati

Modify webpage outputs to replace contents on pages / files

Information :

If you have any bugs issues or problems just post a Issue request.

If you fork or make any changes to improve this or fix problems please do make a pull request for the community who also use this.

Be sure to use the latest Nginx+Lua builds and libraries to avoid any issues.

Usage / Installation :

Edit settings inside anti_ddos_challenge.lua to cater for your own unique needs or improve my work. (Please share your soloutions and additions)

Add this to your Nginx configuration folder.

nginx/conf/lua/

Once installed into your nginx/conf/ folder.

Add this to your HTTP block or it can be in a 服务端 or location block depending where you want this script to run for indi locations the entire 服务端 or every single website on the 服务端.

Example nginx.conf :

This will run for all websites on the nginx 服务端

This will make it run for this website only

This will run in this location block only

Other setup options

For setting up the script to run with Tor .onion services, Cloudflares proxy services, Configuration options of the script view the wiki.

Requirements :

NONE! :D You only need Nginx + Lua to use my scripts.

###### Where can you download Nginx + Lua ?

Openresty provide Nginx + Lua builds for Windows Linux etc here.

Nginx4windows has Windows specific builds with Lua here.

Or you can download the 源码 代码 for Nginx here and compile Nginx yourself with Lua.

About :

I was inspired to create this because of Cloudflare feature "I'm Under Attack Mode"

There are similar sites and services like BitMitigate but I prefer my own script o methods.

I love that feature so much ontop of having it enabled on all my Cloudflare proxied sites I decided to make it into a feature on my own servers so the traffic that hits my servers without coming from Cloudflares 网络 is kept in check and authenticated! (Every little helps right!)

Thank you to for the inspiration and your community for all the love, A big thanks to the community you guys rock Lua rocks you are all so awesome!

Lets build a better internet together! Where Speed, Privacy, Security and Compression matter!

Here are links to my fa communities :)

Protected attack types :

Features :

Ad DDoS Attack Protection

My script gives you Unmetered DDoS mitigation to maintain performance and a for free
Denial of Service attacks continue to grow in sophistication and force: more distributed, greater of traffic, and encroaching on the application layer.
A successful attack increases unnecessary costs on your infrastructure and IT/security staff. More importantly, it hurts your revenue, customer satisfaction, and brand.
To combat attacks and stay online, you’ll need a solution that’s resilient scalable, and intelligent.

#### Common Types of DDoS Attacks

Block Malicious Bot Abuse

Block abusive bots from damaging Internet properties through content scraping, fraudulent checkout, and account takeover.

Prevent Customer Data Breach

Prevent attackers from compromising sensiti data, such as user credentials, credit card information, and other personally identifiable information.

#### Layered Security Defense
layered security approach combines multiple DDoS mitigation capabilities into one service. It prevents disruptions caused by bad traffic, while allowing good traffic through, keeping websites, applications and APIs highly a and performant.
#### HTTP Flood (Layer 7)
HTTP flood attacks generate high of HTTP, GET, or POST requests from multiple sources, targeting the application layer, causing service degradation or una.

Defend against the largest attacks

Shared Network Intelligence / Collecti

With every new property, contributor and person using this script your help and contributions to this script makes e 网络 safer. You are helping identify and block new and e threats across the entire internet back bone / infrastructure.

No Performance Tradeoffs

Eliminate security induced latencies by integrating my script with your servers. You do not need to rely on third party services like Cloudflare, BitMitigate, Sucuri or other such CDN Cloud distributed networks or companies anymore I ha you the 工具 for free.

Web Application Firewall

enterprise-class web application firewall (WAF) protects your Internet property from common like SQL injection attacks, cross-site scripting, and cross-site forgery requests and protectects your existing infrastructure.

Rate Limiting

Control to block suspicious

Rate Limiting protects against denial-of-service attacks, brute-force login attempts, and other types of abusi targeting the application layer.

Rate Limiting provides the ability to configure thresholds, define responses, and gain insights into specific URLs of websites, applications, or API endpoints. It adds granular HTTP/HTTPS traffic control. This also reduces bandwidth costs by eliminating unpredictable traffic spikes or attacks.

Protect any Web Application

This script can protect every web application e.

Go

Protection for go gateways and websites. With foriegn agencies targeting critical infastructure this will help all go and critical ci infastructure stay online.

Payment e-comerce content management

If you use Joomla, Drupal, Wordpress, phpbb, mybb, popular cms or forum software this will ensure maximum uptime and protection.

Military MoD

Military grade protection for infastructure. MoD military of defence / Armed forces websites. Protecting Police and Army core or law enforcement.

Crypto Currency

This script works well for crypto currency sites due to the nature of 钱包 controls security and access of crypto based websites it traffic can run ja and is legitimate before allowing them access protecting sensiti like 钱包 access every crypto website that has a swap or dex / cex centralised or decentralised exchange will find this a must ha for their peer-to-peer marketplace where transactions occur directly between crypto traders.

Tor network / Project .onion :

You can also use this script to protect servers and sites on the Tor 网络 pre ddos on .onion links. It can help stop attacks on the deepweb / darkweb aswell as on the mainline internet for those who browse your site through the tor browser it makes sure they are legitimate users.

HTTP(S) / HTTP2 / HTTP3 / QUIC :

So with modern internet protocols yes this script does work with all of them! It can protect both encrypted and unencrypted connections and traffic served over TCP aswell as UDP the new method for HTTP3/QUIC connections.

Works with :

Nginx

Nginx + Lua

Openresty

Custom Nginx builds with Lua compiled

Litespeed / Litespeedtech as can be seen here the reason this works with Litespeed Lua is because they use Openresty Lua builds on their 服务端 as can be understood here

项目信息

开发语言：Lua

Star 数：1656

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Anti-DDoS script to protect Nginx web servers using Lua with a HTML Javascript based authentication puzzle inspired by Cloudflare I am under attack mode an Anti-DDoS authentication page protect yourself from every attack type All Layer 7 Attacks Mitigating Historic Attacks DoS DoS Implications DDoS All Brute Force Attacks Zero day exploits Social Engineering Rainbow Tables Password Cracking Tools Password Lists Dictionary Attacks Time Delay Any Hosting Provider Any CMS or Custom Website Unlimited Attempt Frequency Search Attacks HTTP Basic Authentication HTTP Digest Authentication HTML Form Based Authentication Mask Attacks Rule-Based Search Attacks Combinator Attacks Botnet Attacks Unauthorized IPs IP Whitelisting Bruter THC Hydra John the Ripper Brutus Ophcrack unauthorized logins Injection Broken Authentication and Session Management Sensitive Data Exposure XML External Entities (XXE) Broken Access Control Security Misconfiguration Cross-Site Scripting (XSS) Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring Drupal WordPress Joomla Flash Magento PHP Plone WHMCS Atlassian Products malicious traffic Adult video script avs KVS Kernel Video Sharing Clip Bucket Tube sites Content Management Systems Social networks scripts backends proxy proxies PHP Python Porn sites xxx adult gaming networks servers sites forums vbulletin phpbb mybb smf simple machines forum xenforo web hosting video streaming buffering ldap upstream downstream download upload rtmp vod video over dl hls dash hds mss livestream drm mp4 mp3 swf css js html php python sex m3u zip rar archive compressed mitigation 代码 源码 sourcecode chan 4chan 4chan.org 8chan.net 8ch 8ch.net infinite chan 8kun 8kun.net anonymous anon tor services .onion torproject.org nginx.org nginx.com openresty.org darknet dark net deepweb deep web darkweb dark web mirror vpn reddit reddit.com adobe flash hackthissite.org dreamhack hack hacked hacking hacker hackers hackerz hackz hacks 代码 coding script scripting scripter 源码 leaks leaked leaking cve vulnerability great firewall china america japan russia .gov government http1 http2 http3 quic q3 litespeedtech litespeed apache torrents torrent torrenting webtorrent bittorrent bitorrent bit-torrent cyberlocker cyberlockers cyber locker cyberbunker warez keygen key generator free irc internet relay chat peer-to-peer p2p cryptocurrency crypto bitcoin miner browser xmr monero coinhive coin hive coin-hive litecoin ethereum cpu cycles popads pop-ads advert advertisement networks banner ads protect ovh blazingfast.io amazon steampowered valve store.steampowered.com steamcommunity thepiratebay lulzsec antisec xhamster pornhub porn.com pornhub.com xhamster.com xvideos xvdideos.com xnxx xnxx.com popads popcash cpm ppc展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。