Installing EdgeWarden

apt update && apt upgrade -y
apt install -y curl sudo wget gnupg ca-certificates unzip \
  net-tools libpcap0.8 tcpdump htop \
  snmp                        # net-snmp: required for SNMPv3

cat > /etc/sysctl.d/99-flowspec-tuning.conf <<'EOF'
# Network buffers — NetFlow/sFlow collector (UDP bursts)
# These are CEILINGS, not allocations: the kernel only reserves what the socket
# asks for. The core asks for 16 MB per socket; the ceiling is generous on purpose.
net.core.rmem_default = 31457280
net.core.rmem_max = 134217728
net.core.wmem_default = 31457280
net.core.wmem_max = 134217728
net.core.netdev_max_backlog = 250000
net.core.optmem_max = 33554432
net.core.somaxconn = 65535
net.core.default_qdisc = fq

# TCP — local ClickHouse + dashboard
net.ipv4.tcp_rmem = 4096 87380 134217728
net.ipv4.tcp_wmem = 4096 65536 134217728
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_no_metrics_save = 1
net.ipv4.ip_local_port_range = 1024 65535

# File/thread limits — core + ClickHouse
# SYSTEM-wide ceiling. This is NOT the per-process limit — see the note below.
fs.file-max = 3263776
fs.aio-max-nr = 3263776
fs.pipe-max-size = 8388608
kernel.threads-max = 1031306
kernel.pid_max = 262144

# Memory — ClickHouse leans hard on page cache; swapping kills latency
vm.swappiness = 1
vm.vfs_cache_pressure = 50
# 256 MB is the cap the kernel itself uses when deriving this value from RAM.
# The old 32768 sat BELOW the default on machines with 64 GB or more.
vm.min_free_kbytes = 262144

# Automatic reboot 3s after a kernel panic (unattended appliance)
kernel.panic = 3
EOF

# Apply and check
sysctl --system 2>&1 | grep -iE "error|cannot|no such" || echo "OK sem erros"
sysctl net.core.rmem_max net.core.netdev_max_backlog vm.min_free_kbytes

timedatectl set-timezone America/Sao_Paulo   # set to your region
apt install -y systemd-timesyncd
printf '[Time]\nNTP=200.160.0.8\nFallbackNTP=a.ntp.br\n' > /etc/systemd/timesyncd.conf
timedatectl set-ntp true
timedatectl status   # "System clock synchronized: yes"

curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
apt install -y nodejs

node --version   # should print v22.x

install -m 0755 -d /etc/apt/keyrings

curl -fsSL 'https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key' | \
    gpg --dearmor -o /etc/apt/keyrings/clickhouse.gpg

echo "deb [signed-by=/etc/apt/keyrings/clickhouse.gpg] https://packages.clickhouse.com/deb stable main" | \
    tee /etc/apt/sources.list.d/clickhouse.list

apt update
apt install -y clickhouse-server clickhouse-client

systemctl enable --now clickhouse-server

curl http://localhost:8123/ping
Ok.

apt install -y mariadb-server mariadb-client redis-server

systemctl enable --now mariadb redis-server

redis-cli ping
PONG

mariadb -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED BY 'SUA_SENHA_MYSQL'; FLUSH PRIVILEGES;"

apt install -y gobgpd

cd /opt
curl -fLO https://www.edgewarden.com.br/download/flowspec-analyzer-stable.tar.gz

tar -xzf flowspec-analyzer-stable.tar.gz -C /opt/
cd /opt/flowspec-analyzer
mkdir -p logs

mkdir -p /etc/flowspec-analyzer
chown -R www-data:www-data /etc/flowspec-analyzer

nano /opt/flowspec-analyzer/config.toml
# in the [storage.clickhouse] section:
#   password = "SUA_SENHA_CH"

cd /opt/flowspec-analyzer

clickhouse-client --password 'SUA_SENHA_CH' -q "CREATE DATABASE IF NOT EXISTS flowspec"

clickhouse-client --password 'SUA_SENHA_CH' --database flowspec --multiquery < database/clickhouse/schema.sql
clickhouse-client --password 'SUA_SENHA_CH' --database flowspec --multiquery < database/clickhouse/seed.sql

# authentication database (creates the default admin user)
mysql -u root -p'SUA_SENHA_MYSQL' < database/mysql/auth_schema.sql

CH_PASS='SUA_SENHA_CH' ./scripts/import-asn-names.sh http://127.0.0.1:8123
CH_PASS='SUA_SENHA_CH' ./scripts/import-ip2asn.sh http://127.0.0.1:8123
CH_PASS='SUA_SENHA_CH' ./scripts/seed-cdn-providers.sh http://127.0.0.1:8123

cd /opt/flowspec-analyzer

# correct ownership BEFORE starting (the services run as www-data)
chown -R www-data:www-data /opt/flowspec-analyzer

cp scripts/systemd/flowspec-core.service \
   scripts/systemd/flowspec-frontend.service \
   scripts/systemd/flowspec-analyzer.target /etc/systemd/system/

# Reinstall the Step 1 tuning from the package so the file is identical
# to what update.sh will maintain from now on (prevents drift).
cp scripts/sysctl/99-flowspec-tuning.conf /etc/sysctl.d/ && sysctl --system

systemctl daemon-reload
systemctl enable --now flowspec-core flowspec-frontend flowspec-analyzer.target

systemctl status flowspec-core flowspec-frontend
● flowspec-core.service — Active: active (running)
● flowspec-frontend.service — Active: active (running)

# 1. Core file descriptors — must read 65535, not 1024
cat /proc/$(pgrep -f flowspec-analyzer-core)/limits | grep "open files"

# 2. Collector socket buffer. The core asks for 16 MB and the kernel DOUBLES
#    the value, so 32 MB is the right number: rb33554432.
#    If you see rb425984, the Step 1 sysctl was not applied.
ss -ulnpme | grep -A1 -E "2055|6343"
grep "Socket buffer" /opt/flowspec-analyzer/logs/core.log.*
Socket buffer: solicitado 16MB, obtido 32MB

# 3. UDP drops — these counters must NOT grow over time
nstat -az | grep -iE "Udp.*(InErrors|RcvbufErrors)"

apt install -y ufw
ufw allow ssh
ufw allow 3099/tcp    # dashboard
ufw allow 2055/udp    # NetFlow
ufw allow 6343/udp    # sFlow
ufw enable
ufw status

systemctl restart flowspec-core

apt install -y apache2 certbot python3-certbot-apache
a2enmod proxy proxy_http proxy_wstunnel ssl headers rewrite
systemctl restart apache2

<VirtualHost *:80>
    ServerName flowspec.example.net

    ProxyPreserveHost On
    ProxyRequests Off

    # WebSocket (real-time dashboard updates)
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:3099/$1 [P,L]

    ProxyPass        / http://127.0.0.1:3099/
    ProxyPassReverse / http://127.0.0.1:3099/

    # IMPORTANT: never set X-Forwarded-Host manually — Apache already
    # sends that header on its own, and duplicating it breaks login (Invalid URL).
    RequestHeader unset X-Forwarded-Host
    # Dynamic scheme (http/https) — stays correct when certbot
    # clones this vhost to port 443:
    RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME}

    ErrorLog  ${APACHE_LOG_DIR}/flowspec-error.log
    CustomLog ${APACHE_LOG_DIR}/flowspec-access.log combined
</VirtualHost>

# 1. Open 80 and 443 BEFORE certbot: it validates the domain over HTTP on
#    port 80, and the Step 9 ufw rules didn't open it. Out of order, it fails.
ufw allow 80/tcp
ufw allow 443/tcp

# 2. Enable the site
a2ensite flowspec
apachectl configtest && systemctl reload apache2

# 3. Issue the certificate (creates the HTTPS vhost and the redirect automatically)
certbot --apache -d flowspec.example.net

# 4. AUTH_URL becomes the domain. Without this, login stops working
#    the moment you switch from the IP to the domain in the browser.
sed -i 's|^AUTH_URL=.*|AUTH_URL=https://flowspec.example.net|' \
  /opt/flowspec-analyzer/frontend/.env.production
systemctl restart flowspec-frontend

# 5. Only AFTER login through the domain works (optional):
#    ufw deny 3099/tcp    # forces access through the domain/HTTPS only

curl -sk -o /dev/null -w "%{http_code} -> %{redirect_url}\n" https://flowspec.example.net/
307 -> https://flowspec.example.net/login

# The file ships ready-made in the package. Copying instead of typing ensures
# it never drifts from what the product tests — and it's worth reading first:
# every key has the reasoning commented next to it.
cat /opt/flowspec-analyzer/scripts/sysctl/99-zz-flowspec-dataplane.conf.example

# The "zz" suffix takes precedence over the Step 1 99-flowspec-tuning:
# sysctl.d applies files alphabetically and the last one to set a key wins.
cp /opt/flowspec-analyzer/scripts/sysctl/99-zz-flowspec-dataplane.conf.example \
   /etc/sysctl.d/99-zz-flowspec-dataplane.conf

sysctl --system 2>&1 | grep -iE "error|cannot|no such" || echo "OK sem erros"
sysctl net.core.netdev_budget net.core.default_qdisc net.core.bpf_jit_harden

cd /opt/flowspec-analyzer/deploy/scrubber
cp scrubber-path.conf.example scrubber-path.conf
$EDITOR scrubber-path.conf              # DIRTY_IF, ROUTER_IP, PROTECT_PREFIXES

./scrubber-path.sh check                # validates, touches nothing
./scrubber-path.sh up                   # brings it up — runtime only
./scrubber-path.sh verify 203.0.113.10  # simulates the decision for one victim

# Only AFTER verify passes, make it permanent:
./scrubber-path.sh up --persist
./scrubber-path.sh status               # should say "Persistência ativa"

IF=eth0   # data plane interface (the one receiving dirty traffic)

# 1. Ring buffers at the MAXIMUM the NIC supports (read from the NIC itself)
RXMAX=$(ethtool -g $IF | awk '/^RX:/{print $2; exit}')
TXMAX=$(ethtool -g $IF | awk '/^TX:/{print $2; exit}')
ethtool -G $IF rx $RXMAX tx $TXMAX

# 2. RSS queues — one per core on the SAME NUMA node as the NIC (see the note)
NODE=$(cat /sys/class/net/$IF/device/numa_node)
NCPU=$(lscpu -p=CPU,NODE | grep -c ",$NODE$")
ethtool -L $IF combined $NCPU

# 3. Adaptive coalescing: fewer IRQs per packet under bursts
ethtool -C $IF adaptive-rx on adaptive-tx on

# 4. Pinned IRQ per queue — irqbalance reshuffles exactly when under load
systemctl disable --now irqbalance

# 5. Which mode did XDP come up in?
ip -d link show $IF | grep -i xdp
#    "xdp"        = native, in the driver — required at this scale
#    "xdpgeneric" = SKB fallback, runs AFTER GRO. In this mode the filter
#                   sees already-coalesced packets and undercounts pps, so:
ethtool -K $IF gro off lro off

# 6. Check whether the NIC is dropping packets (everything should stay at zero)
ethtool -S $IF | grep -iE "drop|discard|miss|nobuf|error" | grep -v ": 0$"