Почему cloudflare не защищает от ddos?

Question

[Vincent1]

Сайт за Claudflare, активировал "Under Attack Mode". И все равно валом идут запросы. Добавление этих ip из лога апача вообще ничего не меняет. В апаче ip я определяю так %{X-Forwarded-For}i

spoiler

3.110.224.178, 3.110.224.178 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
20.213.136.30, 20.213.136.30 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Linux; Android 10; PCT-AL10 Build/HUAWEIPCT-AL10; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/92.0.4515.115 Mobile Safari/537.36 WeRead/6.1.0 (Android; 29; Screen/1080x2208; Scale/2.55)"
20.110.224.153, 20.110.224.153 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://www.kino-teatr.ru/" "Mozilla/5.0 (Linux; Android 4.4.2; SM-T217S Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36"
94.131.207.4, 94.131.207.4 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
73.100.47.167, 73.100.47.167 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36"
146.59.45.142, 146.59.45.142 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
34.95.51.229, 34.95.51.229 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://yandex.ru/search/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
13.70.42.16, 13.70.42.16 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://google.com/" "Mozilla/5.0 (Windows NT 6.0; rv:38.0) Gecko/20100101 Firefox/38.0"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0"
34.211.91.234,139.99.99.165, 139.99.99.165 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
219.78.0.27, 219.78.0.27 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
51.120.77.140, 51.120.77.140 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://vk.com/" "Mozilla/5.0 (Linux; Android 5.0.2; SM-T350 Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Linux; Android 4.0.4; BNTV600 Build/IMM76L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.111 Safari/537.36"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://www.drom.ru/" "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.13 Safari/537.36"
217.146.13.86, 217.146.13.86 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://klops.ru/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; GWX:RESERVED)"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Linux; Android 4.4.2; GT-P5210 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://vk.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:41.0) Gecko/20100101 Firefox/41.0"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://www.kinopoisk.ru/" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0"
47.115.6.196, 47.115.6.196 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://yandex.ru/search/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Safari/537.36"
20.114.240.105, 20.114.240.105 - - [05/Mar/2022:23:24:08 +0300] "GET / HTTP/1.0" 503 1532 "https://www.sports.ru/" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0"
221.132.113.188, 221.132.113.188 - - [05/Mar/2022:23:24:08 +0300] "GET /?0.3382341354758007 HTTP/1.0" 503 1698 "https://sudonull.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"

netstat -antu | awk '$5 ~ /[0-9]:/{split($5, a, ":"); ips[a[1]]++} END {for (ip in ips) print ips[ip], ip | "sort -k1 -nr"}'
95.216.145.50 - типа ip моего впс.

spoiler

7471 95.216.145.50
20 0.0.0.0
15 172.70.210.191
15 162.158.190.153
14 172.70.210.13
14 172.68.25.140
13 51.77.66.181
13 172.70.34.73
13 172.70.206.173
12 172.68.24.189
11 172.70.211.76
10 172.70.35.62
10 172.70.211.88
10 172.70.206.81
10 172.70.206.187
10 172.70.134.99
10 162.158.178.121
9 172.70.134.113
9 172.68.253.5
9 162.158.179.172
9 162.158.119.100
9 141.101.84.59
9 108.162.249.17
8 172.70.135.64
8 172.70.135.58
8 172.70.122.83
8 172.68.253.53
8 162.158.178.206
8 162.158.126.167

Answer 1

[Андрей Гаврилов]

https://support.cloudflare.com/hc/en-us/articles/2...
Нужно сделать, ну и нужно уметь настраивать.