DoS attacks against my online game • Hacker News Board

Re: DoS attacks against my online game

#11

Post by debian3 » Mon, Sep 27, 2021, 9:25 PM UTC

dan_wood wrote: post #8

debian3 wrote: post #4

You should look into OVH. They have those gaming server and they handle the DDOS protection. I was getting hit by DDOS before, but since I moved there, nothing (except an email from OVH to let me know that my server is being attacked and that they are filtering my trafic). On the server itself you just don't feel anything. Edit: I should add that the DDOS protection is included with the server rental and there is no…

I don't think OVH is viable in this case, they do mitigate the attack but in my personal experience they also mitigate legit traffic during the attack. Mind you, this is a process using a single port, with only around 100 active connections. You'll easily see half if not more lose connection during a DDoS attack.

I did notice that a few years back, but now when the filter activate I no longer see any drop in bandwidth usage or any customer complaints. How long ago did you experimented with their filter?

Re: DoS attacks against my online game

#12

Post by cft » Mon, Sep 27, 2021, 9:25 PM UTC

In the US, Cogent offered $900 per month promotion for 10G commit on a 100G burstable circuit. If you rent several rack units and put a used Juniper hardware firewall from eBay in front, that may be one of the cheapest solutions to absorb 100Gbps attacks

Re: DoS attacks against my online game

#13

Post by markus_zhang » Mon, Sep 27, 2021, 9:26 PM UTC

If you received anyone asking whether you need services that defend against DDOS, and if you refused, those are probably the guys who initiated the DDOS attack.

Re: DoS attacks against my online game

#14

Post by leath » Mon, Sep 27, 2021, 9:27 PM UTC

plasma wrote: post #5

A few suggestions: 1. Cloudflare offer TCP based DDoS protection too, see their Magic Transit or Spectrum product 2. This sucks, but put your servers behind WireGuard or Tailscale VPN so that in order to connect you need to have authenticated

As the blogpost mentions TCP is not exactly desirable for our project. Moreover, if you contact Cloudflare about those products you'll get a monthly quote that is far beyond what an open source project run by donations can sustain :)

Re: DoS attacks against my online game

#15

Post by gibs0ns » Mon, Sep 27, 2021, 9:36 PM UTC

def- wrote: post #3

Scaevolus wrote: post #2

DoSing small games like this sucks. Have you looked at ddos-guard's pricing? They seem to be a common budget option.

Thanks for the tip, I didn't know about them. From an initial look $240 for a 1 core vps is a bit too expensive for us.

Also checkout secured.gg [0], I recently discovered them while researching DDoS solutions used by other popular game servers (for Minecraft, and GTA5). I haven't used them but their pricing seemed reasonable to me.

[0] https://secured.gg/dedicated

Re: DoS attacks against my online game

#16

Post by tyingq » Mon, Sep 27, 2021, 9:37 PM UTC

"For the individual server infos the client currently has to communicate with each game server by UDP, thus revealing its own IP address without having connected to a server. Since one of the known attackers is running their own DDNet server, they can use this method to collect legitimate player IP addresses and spoof them in their attacks."

Interesting. I wonder if running an overlay network would help there. More choices today for userspace overlay networks. Rogue server owners would still see an IP, but they could only attack it from their connected server, not the internet at large. And you could do some kind of ingress/egress filtering.

Some sort of periodic coordinated switching from UDP port A to port B might help too, like a control message that tells the game client to switch ports. Or randomized initial port assignments combined with filters/firewalling or just in-band 'you're not supposed to send here, bye'.

Re: DoS attacks against my online game

#17

Post by debian3 » Mon, Sep 27, 2021, 9:37 PM UTC

leath wrote: post #10

debian3 wrote: post #4

You should look into OVH. They have those gaming server and they handle the DDOS protection. I was getting hit by DDOS before, but since I moved there, nothing (except an email from OVH to let me know that my server is being attacked and that they are filtering my trafic). On the server itself you just don't feel anything. Edit: I should add that the DDOS protection is included with the server rental and there is no…

We've had several servers with OVH, including their kimisufi line, So You Start GAME line, their standard GAME line and their standard servers. While I'm sure these are great for common games their DDoS protection seems to get confused by our very non-standard protocol, ending up blocking most if not all traffic from non-connected players.

Might sound strange, but you could always contact @olesovhcom on Twitter. He is the CEO of OVH and he made change to their DDOS filter base on what we reported to him. He is always interested in improving is offering. But that was maybe 5 years ago, now maybe he will put you in contact with someone else, but back then they were actively looking for feedback to improve their filter.

Edit: you could always contact their support as well. Fighting DDOS on your own it's an expensive/difficult battle. But their DDOS filter is fully custom (mostly Asic and some Arbor as well).

Re: DoS attacks against my online game

#18

Post by 123pie123 » Mon, Sep 27, 2021, 9:37 PM UTC

I've no idea how complex this is to code or if it will work for you

but I'll throw the idea out to see if anyone else could improve on it etc..

initial strawman draft idea: have a front door service that just verifies your gamers (eg log on server) This will need to be protected by a Ddos but the throughput shouldn't be large. once authenticated your clients IP address is then passed to some sort of software based firewall protecting each of the main game servers

Re: DoS attacks against my online game

#19

Post by noobgrammer » Mon, Sep 27, 2021, 9:49 PM UTC

EDIT: Cloudflare already made a game demo on Workers... multiplayer Doom: https://blog.cloudflare.com/doom-multiplayer-workers/ that was written using WASM + WebSockets, porting over an open-source Doom and shimming in a UDP-over-Websockets networking layer. Despite all that, it's still fast enough for a first person shooter.

Original post: Have you looked into using a serverless pub/sub model, like Cloudflare's Workers KV? The example they give is a simple IRC-like distributed chatroom (https://github.com/cloudflare/workers-chat-demo), but theoretically it may work for games too.

Player state can be stored in a decentralized key-value store that Cloudflare manages (Cloudflare Durable Objects). They absorb all the DDoS and handle replication between edge nodes. You don't see any of that. https://developers.cloudflare.com/workers/learning/using-dur...

Then each game client uses a worker to access that KV on a subscription basis, and Cloudflare will route that worker to its nearest edge node and retrieve the state from there (which was previously replicated a moment ago, internal to Cloudflare's infrastructure). Changes to state are replicated across the edge network and pushed to client workers.

https://workers.cloudflare.com/

I don't know if this would result in acceptable latency, but it could help with DDOS at least. The main benefit is that it's incredibly affordable, especially when you're only talking about thousands of players.

Re: DoS attacks against my online game

#20

Post by Deathmax » Mon, Sep 27, 2021, 9:52 PM UTC

123pie123 wrote: post #18

I've no idea how complex this is to code or if it will work for you but I'll throw the idea out to see if anyone else could improve on it etc.. initial strawman draft idea: have a front door service that just verifies your gamers (eg log on server) This will need to be protected by a Ddos but the throughput shouldn't be large. once authenticated your clients IP address is then passed to some sort of software based fi…

The firewall would need to be able to handle all the DDoS traffic as well, since your current idea would still pass the game server's IP back to a client. This is doable if you're hosting on a cloud provider and let their firewalls filter the traffic before hitting the game server.

Embark Studios recently open sourced (in alpha) a UDP proxy[1] designed for games that lets you implement a load balancing layer. This allows you to remove servers in the load balancing layer in the event that it comes under attack, allowing the game server to stay up and only having to disconnect a portion of players connected to the attacked loadbalancer. Having a proxy layer is also how Steam protects game servers using the Steam Datagram Relay[2].

[1]: https://github.com/googleforgames/quilkin [2]: https://partner.steamgames.com/doc/features/multiplayer/stea...