aether/haproxy-bot-protection
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
HAProxy bot protection config
2 commits 1 branch 0 tags 32 KiB
  • Shell 86.7%
  • Lua 13.3%
Find a file
Exact
aether 8f63c6935d add: WTFPL license
2026-06-09 08:50:35 +07:00
lists initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00
scripts initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00
.gitignore initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00
bot-protection.lua initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00
country-block.map initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00
haproxy.cfg initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00
README.md add: WTFPL license 2026-06-09 08:50:35 +07:00
setup.sh initial: HAProxy bot protection config stack 2026-06-09 08:45:01 +07:00

README.md

HAProxy Bot Protection

HAProxy config for bot protection on a public proxy server. Blocks scrapers, scanners, flood attacks, and unwanted traffic at the edge before it reaches your backend.

Layers

  1. Domain guard (404 if hostname doesn't match)
  2. Connection rate limiting (50 conn/10s)
  3. HTTP request rate limiting (100 req/10s)
  4. Error rate scanner detection (20+ 4xx/1m)
  5. User-Agent blocklist (90+ known bad agents)
  6. Live IP blacklist (Spamhaus, Firehol, Blocklist.de)
  7. GeoIP country blocking (via MaxMind + Lua)
  8. CONNECT flood protection
  9. Proxy authentication

Files

  • haproxy.cfg - Main HAProxy config (forward + reverse proxy)
  • bot-protection.lua - GeoIP lookup script for HAProxy Community
  • lists/bad-user-agents.lst - Known bad User-Agents
  • country-block.map - Country codes to block
  • scripts/update-blacklists.sh - Daily IP blacklist updater
  • scripts/update-geoip.sh - MaxMind GeoIP database downloader
  • setup.sh - Full setup script

Requirements

  • HAProxy 2.x+ with Lua support
  • lua-maxminddb (for GeoIP)
  • Free MaxMind account for GeoLite2 databases

Quick start

apt install lua-maxminddb
./scripts/update-geoip.sh YOUR_MAXMIND_KEY
./scripts/update-blacklists.sh
haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl reload haproxy

ASN blocking

On the backlog. Will use nftables raw table sets for firewall-level ASN blocking.

License

DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE Version 2, December 2004

Copyright (C) 2026 Lele

Everyone is permitted to copy and distribute verbatim or modified copies of this license document, and changing it is allowed as long as the name is changed.

DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  1. You just DO WHAT THE FUCK YOU WANT TO.