Install KillBot on a clean Ubuntu 22.04 server with no other software preinstalled. It must be a separate server, not the server that hosts your website.
Deploy a clean Ubuntu 22.04 server and run the following commands:
sudo apt update
sudo apt-get install -y wget
wget -t1 -O kbi.sh https://raw.githubusercontent.com/grigoriy-melnikov/KillBot/main/kb_install.sh
chmod +x kbi.sh
yes '' | sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a ./kbi.sh
/opt/killbot
This is the directory where KillBot is installed.
During installation, KillBot deploys both Nginx and Apache.
KillBot creates a separate configuration for each server:
/etc/nginx/sites-enabled/domain.ru.conf accepts incoming requests and proxies them to Apache on port 8443.
/etc/apache2/sites-enabled/domain.ru-killbot.conf is the Apache configuration generated by KillBot.
The Apache and Nginx configuration files are generated through the web interface at killbot.ru. Any manual changes made to these files will be overwritten the next time you save the project settings in the KillBot dashboard.
DDoS protection on your own KillBot server
When you install KillBot on your own server, the installer also deploys built-in DDoS protection.
KillBot provides DDoS protection at two levels:
- The
/opt/killbot/f2b/subnet-monitor.shscript analyzes/var/log/nginx/access.logand uses iptables to block abusive IP addresses or subnets. - Nginx limits the number of requests sent to the same URL.
Blocking IP addresses with subnet-monitor.sh
The subnet-monitor.sh script blocks IP addresses and network ranges that generate excessive traffic. The script is located at /opt/killbot/f2b/subnet-monitor.sh.
It runs once per minute through Cron. Its scheduled task is defined in /etc/cron.d/killbot-cleanup:
The script analyzes the Nginx access log. If a single IP address sends more than 1,000 requests per minute, that address is blocked through iptables for one hour. The same logic applies to /24 and /16 networks when they generate excessive traffic.
Blocking thresholds for subnet-monitor.sh are configured in a separate file named subnet-monitor.conf:
Add trusted IP addresses or network ranges to subnet-monitor-whitelist.conf to exclude them from these limits:
Viewing and clearing blocked IP addresses and other subnet-monitor.sh commands
subnet-monitor.sh show — displays currently blocked IP addresses.
subnet-monitor.sh clear — removes the current IP blocks.
subnet-monitor.sh run — immediately analyzes /var/log/nginx/access.log and applies IP blocks when the configured limits are exceeded.
subnet-monitor.sh test — displays test data showing the number of requests from each IP address or network range.
Disabling subnet-monitor.sh
To disable subnet-monitor.sh completely, comment out its Cron entry in /etc/cron.d/killbot-cleanup.
Limiting requests at the Nginx level
Nginx limits the number of requests sent to a specific URL. This is useful when a botnet uses many different IP addresses but repeatedly attacks the same path on the website. In that case, only the targeted URL may become temporarily unavailable while the rest of the website continues to work. The screenshot below shows the settings that limit requests across the entire domain and to a specific URL:
By default, the limit is 200 requests per minute to a single URL and 500 requests per second across the entire domain. These limits leave plenty of headroom for legitimate visitors while providing a practical safeguard against traffic spikes and overloads. If you do not need these limits, you can comment out the lines highlighted in red in the screenshot above or increase their values in /etc/nginx/nginx.conf.
When a limit is triggered, the event appears in the Nginx log and the browser displays 429 error page.
Uploading your own SSL certificates to the KillBot server
To use your own certificates on the KillBot server:
- In the KillBot project settings, select the self-signed certificate option:
- Upload the certificate files to the following paths:
/opt/killbot/ssl/domain.ru/privkey.pem— private key
/opt/killbot/ssl/domain.ru/fullchain.pem— full certificate chain
Replacedomain.ruwith your domain name. The private key and certificate chain must use the exact filenames shown above.
After uploading the files, open the project settings at killbot.ru and click Reload DNS at the bottom of the page. KillBot checks this directory for the certificate files and, if they are present, adds their paths to the generated Apache and Nginx configurations.