Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to survive indefinite DDoS attack?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Ask HN: How to survive indefinite DDoS attack?

#21

Post by hknmtt »

jackconsidine wrote: post #17

People mention Cloudflare. Google Cloud Armor is another option (we looked into both). A colleague was DDoS attacked and was able to move the service behind Cloud Armor in a few hours, effectively ending a ridiculous barrage of network requests. I think CA charges a minuscule amount per request, and can be capped with a fix monthly cost which limits the DDoS liability.

but all how are all these services able to let in valid traffic? won't they simply cut me off altogether to protect my infrastructure at the cost of no access for my users?

Re: Ask HN: How to survive indefinite DDoS attack?

#22

Post by JohnMakin »

Thaxll wrote: post #3

Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.

You can also whitelist the cloudflare IP's and block all other traffic, that way the only traffic hitting your origin is through the proxy.

Re: Ask HN: How to survive indefinite DDoS attack?

#23

Post by josevalerio »

As others have stated, Cloudflare is the best solution here. Other services like AWS WAF will charge you just for validating requests, which means even if the DDOS is mitigated, you're still paying for it to inspect each request and then block it, which now turns it to a denial of wallet attack.

Re: Ask HN: How to survive indefinite DDoS attack?

#25

Post by tekla »

hknmtt wrote: post #20
Thaxll wrote: post #3

Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.

ever since cloudflare went political and started kicking off customers for their opinions, i never touched that service and never will. and i have a very long memory. but alternatives are welcome.

I can't think of a single service that would have held off against censorship anywhere near as long as CF did, that also doesn't suck.

Re: Ask HN: How to survive indefinite DDoS attack?

#26

Post by 0xEFF »

pjc50 wrote: post #12
StevenWaterman wrote: post #7

Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it). Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out. If checking the auth is expensive enough to cause problems, require…

That's "building your own cloudflare". > Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic The traffic is from compromised devices, so it's very cheap.

Even so, the suggestion is a good one. Modern proxies have gotten much better at handling auth and processing the traffic as the GP describes. Service meshes have these features built in now when a few years ago we had to roll our own solutions with haproxy or nginx.

Re: Ask HN: How to survive indefinite DDoS attack?

#27

Post by ElectricalUnion »

JohnMakin wrote: post #22
Thaxll wrote: post #3

Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.

You can also whitelist the cloudflare IP's and block all other traffic, that way the only traffic hitting your origin is through the proxy.

If under heavy DDOS, it's very likely that your available upstream/downstream bandwidth is already starved, so dropping requests at your public IP level is too late.

Re: Ask HN: How to survive indefinite DDoS attack?

#28

Post by pjc50 »

hknmtt wrote: post #21
jackconsidine wrote: post #17

People mention Cloudflare. Google Cloud Armor is another option (we looked into both). A colleague was DDoS attacked and was able to move the service behind Cloud Armor in a few hours, effectively ending a ridiculous barrage of network requests. I think CA charges a minuscule amount per request, and can be capped with a fix monthly cost which limits the DDoS liability.

but all how are all these services able to let in valid traffic? won't they simply cut me off altogether to protect my infrastructure at the cost of no access for my users?

The entire business model is in not cutting you off, but cutting off the requests. E.g. by forwarding them to the cloudflare captcha first.

This does mean occasional false positives.

Re: Ask HN: How to survive indefinite DDoS attack?

#29

Post by hoffs »

fvv wrote: post #15
djbusby wrote: post #6

Earlier quoted context omitted.

I hate that this is the right answer. I hate that I use it too. I hate that I don't have time/cash to explore alternatives.

because alternatives usually cost several thousands $/months.. what has the internet become? Why not create blacklists (even on a timed basis) with the IPs to block at BGP level? and these blacklists managed by bodies, - okay they are bodies..., but at least they can be open foundations to which it is not mandatory to join (as in the case of cloudflare)- available to BGP backbones and routed on a network, castrate th…

So if someone becomes part of the bonnet, they are denied all access to the internet

Re: Ask HN: How to survive indefinite DDoS attack?

#30

Post by ElectricalUnion »

hknmtt wrote: post #21
jackconsidine wrote: post #17

People mention Cloudflare. Google Cloud Armor is another option (we looked into both). A colleague was DDoS attacked and was able to move the service behind Cloud Armor in a few hours, effectively ending a ridiculous barrage of network requests. I think CA charges a minuscule amount per request, and can be capped with a fix monthly cost which limits the DDoS liability.

but all how are all these services able to let in valid traffic? won't they simply cut me off altogether to protect my infrastructure at the cost of no access for my users?

The idea is that a IP under heavy DDOS already has effectively 0% availability anyways. More that 0% is a infinite availability increase.
Post reply on HN