Skip to content

UPGRADE.md

Latest commit

 

History

History
153 lines (109 loc) · 3.88 KB

UPGRADE.md

File metadata and controls

153 lines (109 loc) · 3.88 KB
Raw

Upgrade Guide - DDoS Protection

For Existing Agents

If you installed DefenraAgent before kernel-level DDoS protection was added, you need to upgrade your system configuration.

What Gets Upgraded

The upgrade script adds:

  1. Kernel Tuning - SYN cookies, connection tracking, TCP optimization
  2. IPSet - O(1) IP blocking (50,000x faster than iptables)
  3. iptables Rules - Integration with ipset for efficient blocking
  4. Persistence - All settings survive reboot

One-Line Upgrade

curl -sSL https://raw.githubusercontent.com/Defenra/DefenraAgent/main/upgrade-ddos-protection.sh | sudo bash

What Happens

  1. Checks if DefenraAgent is installed
  2. Installs iptables and ipset packages
  3. Applies kernel tuning to /etc/sysctl.d/99-defenra.conf
  4. Creates ipset sets: defenra-blacklist, defenra-tempban, defenra-cidr
  5. Configures iptables rules to use ipset
  6. Sets up systemd service for persistence
  7. Restarts DefenraAgent

Verify Upgrade

Check that ipset mode is enabled:

sudo journalctl -u defenra-agent -n 50 | grep ipset

Expected output:

[Firewall] ipset detected, using ipset for IP blocking (O(1) lookup)

Check kernel settings:

sysctl -a | grep tcp_syncookies
# Should output: net.ipv4.tcp_syncookies = 1

List ipset sets:

sudo ipset list -t
# Should show: defenra-blacklist, defenra-tempban, defenra-cidr

Performance Improvement

After upgrade, you should see:

Metric Before After
TLS handshakes/sec 1,000 10,000+
CPU usage (TLS flood) 100% ~10%
IP blocking lookup O(n) O(1)
Max connections 65K 2M

Troubleshooting

Problem: ipset not detected after upgrade

Solution:

# Check if ipset is installed
which ipset

# If not installed, install manually
sudo apt-get install ipset  # Debian/Ubuntu
sudo yum install ipset       # CentOS/RHEL

# Restart agent
sudo systemctl restart defenra-agent

Problem: Kernel settings not applied

Solution:

# Apply manually
sudo sysctl -p /etc/sysctl.d/99-defenra.conf

# Verify
sysctl -a | grep tcp_syncookies

Problem: ipset sets not created

Solution:

# Run setup script manually
sudo bash DefenraAgent/setup-ipset.sh

# Or create manually
sudo ipset create defenra-blacklist hash:ip family inet hashsize 4096 maxelem 1000000
sudo ipset create defenra-tempban hash:ip family inet hashsize 4096 maxelem 1000000 timeout 3600
sudo ipset create defenra-cidr hash:net family inet hashsize 1024 maxelem 100000

Rollback

If you need to rollback the upgrade:

# Remove kernel tuning
sudo rm /etc/sysctl.d/99-defenra.conf
sudo sysctl --system

# Remove ipset sets
sudo ipset destroy defenra-blacklist
sudo ipset destroy defenra-tempban
sudo ipset destroy defenra-cidr

# Remove iptables rules
sudo iptables -D INPUT -m set --match-set defenra-blacklist src -j DROP
sudo iptables -D INPUT -m set --match-set defenra-tempban src -j DROP
sudo iptables -D INPUT -m set --match-set defenra-cidr src -j DROP

# Restart agent
sudo systemctl restart defenra-agent

Agent will fall back to legacy iptables mode (O(n) lookup).

For New Installations

New installations via quick-install.sh automatically include all DDoS protection features. No upgrade needed.

Documentation

Support

If you encounter issues during upgrade:

  1. Check logs: sudo journalctl -u defenra-agent -n 100
  2. Verify ipset: sudo ipset list -t
  3. Check kernel settings: sysctl -a | grep -E "tcp_syncookies|nf_conntrack_max"
  4. Contact support: support@defenra.cc