Can nginx be configured to send zero response data and immediately close the connection?

Geuis

4/25/24, 12:10 AM

Can nginx be configured to send zero response data and immediately close the connection? I'm trying to avoid sending absolutely any outbound data for a certain class of inbound connections.

I found a possible solution here https://stackoverflow.com/a/17010681/68788 from a number of years back:

location /ip/ {
    keepalive_timeout 0;
}

But I don't know if keepalive_timeout 0; will keep nginx from still sending outbound headers when it closes the connection.

For some background, a few months ago one of my sites became the target of a massive DDoS. I had to switch to Cloudflare's WAF (web application firewall) to allow me to filter out the impinging traffic. The total inbound + outbound traffic is a 3000% increase and the costs potentially could have been pretty terrible.

The inbound attack is still ongoing. Terabytes of useless traffic every day for months.

However it turns out there's an unexpected issue with Cloudflare's WAF proxy that prevents parts of my service from working correctly. (The details don't matter for this question. I've been down that rabbit hole for weeks and its something with how Cloudflare terminates ipv4 and ipv6 traffic.)

Now I'm thinking I may need to roll out a different solution to fix the service. I might be able to manage this if I can get nginx to send absolutely zero outbound data for the class of inbound connections I'm targeting. The main goal is to have 0 outbound data transfer costs for terminating inbound connections that I am filtering out.

Appreciate any help.

119

1 + 2

nginx

Jaromanda X

4/25/24, 1:36 AM

I used a firewall to solve my DDOS problem a few years ago. Admittedly, that wasn't on cloudflare, and also I don't know what you mean by *"class of inbound connections"* - sounds like if it's a particular class, a firewall is the best tool for the job

Geuis

4/25/24, 1:43 AM

@JaromandaX Yes, Cloudflare's WAF proxy is a web application firewall. And yes, like I mentioned in the question that is something I'm already using.

Score:1

Server

kolbyjack

4/25/24, 2:12 PM

Use return 444;

From the documentation:

Stops processing and returns the specified code to a client. The non-standard code 444 closes a connection without sending a response header.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Can nginx be configured to send zero response data and immediately close the connection?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.