Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to survive indefinite DDoS attack?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: Ask HN: How to survive indefinite DDoS attack?

#41

Post by gwnywg »

I'm on Linode since ~2012 and some time ago they added free ddos prottection to their offering, it was advertised on HN too [1]. Hetzner is also offering something to mitigate ddos.

There was HN thread asking the same question [2]

Having said this, none of my services were targetted by ddos, it made me thinking that maybe maintaining a list of 'healthy' clients IP addresses during good time and then banning anything from outside of that list in bad times? Sounds lame I know, I wait for ideas emerging in this thread :)

[1] https://news.ycombinator.com/item?id=22144369

[2] https://news.ycombinator.com/item?id=12376596

Re: Ask HN: How to survive indefinite DDoS attack?

#43

Post by andrewmcwatters »

My question is, what did people do before Cloudflare? There are different types of DDoS attacks. I vaguely remember what we did over a decade ago, which was blackhole IPs. I'm not sure if people still do this directly with iptables, but at the time, this was the bread-and-butter approach for transport DDoS. If your issue was web application related, then you'd move up to fail2ban.

DDoS protection for web applications is a different beast than raw transport.

If you're a vicim of an amplified DDoS attack, your filtering may need to occur off the server.

Re: Ask HN: How to survive indefinite DDoS attack?

#44

Post by sredevops01 »

gwnywg wrote: post #41

I'm on Linode since ~2012 and some time ago they added free ddos prottection to their offering, it was advertised on HN too [1]. Hetzner is also offering something to mitigate ddos. There was HN thread asking the same question [2] Having said this, none of my services were targetted by ddos, it made me thinking that maybe maintaining a list of 'healthy' clients IP addresses during good time and then banning anything…

Yeah essentially this. Then have something crawl your database and find IP's that are crawling your dummy pages, and block those. Most of it is EC2/GCP instances and Azure VMs that people spin up with stolen cards, so you have to block a lot of 3rd party vendors. OVH and some others came up often. Lot's of crawling companies were using end user VPNs, so those are harder to block.

The best thing I found was dummy pages to block IPs of bad actors. Also, serving different urls with JS enabled versus disabled, but showing your page as something that works without JS.

Unfortunately, as good as CloudFlare is, their layer-7 isn't going to help you if someone is targeting you.

Re: Ask HN: How to survive indefinite DDoS attack?

#45

Post by kijin »

ElectricalUnion wrote: post #27
JohnMakin wrote: post #22

Earlier quoted context omitted.

You can also whitelist the cloudflare IP's and block all other traffic, that way the only traffic hitting your origin is through the proxy.

If under heavy DDOS, it's very likely that your available upstream/downstream bandwidth is already starved, so dropping requests at your public IP level is too late.

If you're under attack now, you should get a new public IP first. Then you can hide behind Cloudflare and drop all unproxied connections. Unless and until you get a new IP, no amount of Cloudflare wizardry can stop all the direct traffic that you're already getting.

If your host's bandwidth is so completely saturated by the attack that no amount of IP switching will help, well, you should find a new host.

Re: Ask HN: How to survive indefinite DDoS attack?

#46

Post by snorkel »

Lookup edge service providers like Cloudflare or Akamia. If you’re hosted by a large cloud provider then look into their free and premium edge services offerings. Traffic can be filtered to allow legit users, and consider scaling up servers too if cost of downtime outweighs cost of edge services and scaling up.

Re: Ask HN: How to survive indefinite DDoS attack?

#49

Post by rattlyy »

bosch_mind wrote: post #37
bityard wrote: post #14

I work for a company in the DDoS mitigation space and there is not nearly enough information in your question for anyone to offer any kind of sensible response for your particular situation. What is your business? How much traffic "normal" do you get? What is the size of the attack? What is the bandwidth of your upstream connection? Who are your customers? Where is it hosted? What are your acceptable thresholds for f…

Who would be more advanced than Cloudflare?

DDoS-Guard, it's basically cloudflare russia edition that is used by controversial websites like Parler, 8chan etc that will get ddosed indefinitely.

Re: Ask HN: How to survive indefinite DDoS attack?

#50

Post by kijin »

sredevops01 wrote: post #44
gwnywg wrote: post #41

I'm on Linode since ~2012 and some time ago they added free ddos prottection to their offering, it was advertised on HN too [1]. Hetzner is also offering something to mitigate ddos. There was HN thread asking the same question [2] Having said this, none of my services were targetted by ddos, it made me thinking that maybe maintaining a list of 'healthy' clients IP addresses during good time and then banning anything…

Yeah essentially this. Then have something crawl your database and find IP's that are crawling your dummy pages, and block those. Most of it is EC2/GCP instances and Azure VMs that people spin up with stolen cards, so you have to block a lot of 3rd party vendors. OVH and some others came up often. Lot's of crawling companies were using end user VPNs, so those are harder to block. The best thing I found was dummy page…

Cloudflare's layer-7 protection is crap, but it's still orders of magnitude more effective than anything Linode or Hetzner can pull off.

Any major cloud or datacenter can block an old-fashioned UDP flood these days, but botnets have evolved too. Now they speak TLS and HTTP/2, and can send (relatively) small amounts of traffic to select endpoints to generate a large load.

In addition to blocking layer-3 and layer-4 floods, the DDoS mitigation service needs to MITM all your layer-7 traffic in order to determine which requests are legit. Cloudflare can do this (to some extent). AWS WAF can do this. Regular hosting companies can't, unless you use their load balancer and let them manage your TLS keys for you.

Post reply on HN