I have some cheap(east) VPS with OVH that I didn't even know had DDoS protection until I got the emails that my host was temporarily migrated to mitigation infrastructure during a DDoS, and back a few minutes later. Was pretty impressed especially since I don't pay extra for it or even know I had it!
DDoS Protection
21–30 of 56 posts
Re: DDoS Protection
#22At the risk of sounding like the "why do you need DropBox if you have rsync herr derr" guy, why... do I need DDoS protection from my VPS provider if I have Cloudflare anyway?
Isn't it trivial to discover the origin IP and then just hit it directly?
You can use Cloudflare tunnel so there's no "origin" exposed.
Re: DDoS Protection
#23One question, what's current best practice for DDOS prevention on my own VPS Ubuntu box ?
D/DOS protections mostly have to happen before the network packet reaches the OS. Handling the incoming data request requires enough OS resources to be used for DOS. There are some things you can do application wise, such as avoiding reflection and amplification attacks. https://blog.cloudflare.com/reflections-on-reflections/
Re: DDoS Protection
#24At the risk of sounding like the "why do you need DropBox if you have rsync herr derr" guy, why... do I need DDoS protection from my VPS provider if I have Cloudflare anyway?
Cloudflare doesn't proxy all applications, just HTTPS.
It can e.g. magic transit. Might cost a lot more and might not work as good, but you can.
Re: DDoS Protection
#25Earlier quoted context omitted.
Don’t get DDoS’d or use a provider that has built-in DDoS protection. Depending on what you’re using it for you could “cloak” it.
What if the situation is the provider doesn't have built-in DDos protection ?
Then you switch providers, go behind something like cloud flare, or contract with a DDoS protection provider (there aren’t many).
If it is an unimportant service you just suffer the DDoS or switch IPs.
Or you use a front end on a VPS that does have DDoS and use a IPv6 tunnel or tail scale to connect to your actual service.
Re: DDoS Protection
#26At the risk of sounding like the "why do you need DropBox if you have rsync herr derr" guy, why... do I need DDoS protection from my VPS provider if I have Cloudflare anyway?
What if you want to run a service that can't go behind Cloudflare (such as a game server)?
We have plenty of game servers behind us. See Cloudflare Spectrum: https://developers.cloudflare.com/spectrum/
Re: DDoS Protection
#27For comparison, I believe AWS LightSail users might be covered for DDOS protection for free but maybe I'm reading too much into their statement.
https://docs.aws.amazon.com/waf/latest/developerguide/ddos-s...
Re: DDoS Protection
#28Earlier quoted context omitted.
Don’t get DDoS’d or use a provider that has built-in DDoS protection. Depending on what you’re using it for you could “cloak” it.
What if the situation is the provider doesn't have built-in DDos protection ?
Well you just have to find a way to eat the traffic without using up too many resources. Rate-limit by IP, drop certain types of packets, cache aggressively, respond to 400 errors with empty response, timeout long-running requests etc.
Re: DDoS Protection
#29Earlier quoted context omitted.
Cloudflare doesn't proxy all applications, just HTTPS.
It can e.g. magic transit. Might cost a lot more and might not work as good, but you can.
Correct yes - although having used a provider that used Magic Transit as protection I can safely say it's a terrible option.
Re: DDoS Protection
#30Earlier quoted context omitted.
It can e.g. magic transit. Might cost a lot more and might not work as good, but you can.
Correct yes - although having used a provider that used Magic Transit as protection I can safely say it's a terrible option.
> I can safely say it's a terrible option.
Can you elaborate?