0

Can nginx be configured to send zero response data and immediately close the connection? I'm trying to avoid sending absolutely any outbound data for a certain class of inbound connections.

I found a possible solution here https://stackoverflow.com/a/17010681/68788 from a number of years back:

location /ip/ { keepalive_timeout 0; } 

But I don't know if keepalive_timeout 0; will keep nginx from still sending outbound headers when it closes the connection.

For some background, a few months ago one of my sites became the target of a massive DDoS. I had to switch to Cloudflare's WAF (web application firewall) to allow me to filter out the impinging traffic. The total inbound + outbound traffic is a 3000% increase and the costs potentially could have been pretty terrible.

The inbound attack is still ongoing. Terabytes of useless traffic every day for months.

However it turns out there's an unexpected issue with Cloudflare's WAF proxy that prevents parts of my service from working correctly. (The details don't matter for this question. I've been down that rabbit hole for weeks and its something with how Cloudflare terminates ipv4 and ipv6 traffic.)

Now I'm thinking I may need to roll out a different solution to fix the service. I might be able to manage this if I can get nginx to send absolutely zero outbound data for the class of inbound connections I'm targeting. The main goal is to have 0 outbound data transfer costs for terminating inbound connections that I am filtering out.

Appreciate any help.

2
  • I used a firewall to solve my DDOS problem a few years ago. Admittedly, that wasn't on cloudflare, and also I don't know what you mean by "class of inbound connections" - sounds like if it's a particular class, a firewall is the best tool for the job Commented Apr 25, 2023 at 1:36
  • @JaromandaX Yes, Cloudflare's WAF proxy is a web application firewall. And yes, like I mentioned in the question that is something I'm already using. Commented Apr 25, 2023 at 1:43

1 Answer 1

2

Use return 444;

From the documentation:

Stops processing and returns the specified code to a client. The non-standard code 444 closes a connection without sending a response header.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.