31–40 of 56 posts
Earlier quoted context omitted.
Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.
That protects you from dumb attackers who don't understand how things work. How will you protect the origin?
Earlier quoted context omitted.
Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.
The free and $20 plan doesn't cover all DDoS attacks. The real stuff costs more than I spend on my entire monthly infrastructure. For my use case, it would cost $6000/mo (I need wildcards and full DDoS mitigation). I'm sure $6k is cheap for someone, but it's not cheap for us. Meanwhile, providers like OVH, Ramnode, Vultr and BuyVM offer various levels of integrated DDoS protection for their servers and VPS for free o…
Earlier quoted context omitted.
CloudFlare protection can be easily bypassed. These types of proxy services which offer decently cheap DDoS protection are fine for defending against small-time attacks, however, plenty of attackers have scripts capable of bypassing them.
What scripts are capable of bypassing CloudFlare/proxy services and how do they do it? Do they look for old DNS records that leak their Origin IP or something like that?
Spin up a hefty AWS instance and connect to every single IPv4 IP while sending a HTTP get request on successful connects with a Host matching that of the domain. There are only 4 billion IPs. Look for successful code 200's with the same headers and content as the original website. Easier said than done though.
Btw, this attack can be prevented if you run a drop-all firewall and only whitelist the IPs listed here: https://www.cloudflare.com/ips/
Earlier quoted context omitted.
That protects you from dumb attackers who don't understand how things work. How will you protect the origin?
By never revealing the IP address of the origin. Conceal it completely behind CF. A properly configured CF setup will mean your real server IP never gets revealed ever.
Earlier quoted context omitted.
There really isn't any beyond having a large pipe connected to a network device capable of filtering a high volume of pps. That has always been the problem with competently executed DDoS attacks. You need a very large pipe as Step #1 which is simply not cost effective for most businesses. :/
Actually there are providers which will sell you a port ACL as part of their DDoS mitigation service. These ACLs can block almost all of the BS volumetric attacks which will cripple you. Everything gets blocked on the provider side. NTT's pricing is especially reasonable. TWTC has a similar service.
People sell DDoS mitigation but that isn't anything close to a business being able to mitigate things and caring about best practices.
Earlier quoted context omitted.
Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.
The free and $20 plan doesn't cover all DDoS attacks. The real stuff costs more than I spend on my entire monthly infrastructure. For my use case, it would cost $6000/mo (I need wildcards and full DDoS mitigation). I'm sure $6k is cheap for someone, but it's not cheap for us. Meanwhile, providers like OVH, Ramnode, Vultr and BuyVM offer various levels of integrated DDoS protection for their servers and VPS for free o…
BuyVM promises 500Gbps protection for $3/mo, whereas Vultr offers only 10Gbps protection for $10/mo. The pricing is all over the place. I would naturally assume that the quality is all over the place, too.
Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this u…
Most residential Canadian internet connections have bandwidth caps. They're usually between 20gb and 200gb. Customers could only wish that their markup on overage was just 30x...
Earlier quoted context omitted.
By never revealing the IP address of the origin. Conceal it completely behind CF. A properly configured CF setup will mean your real server IP never gets revealed ever.
Not always possible without expensive plans. For example, if you use websockets you will need a business/enterprise level plan in order to pipe through cloudflare. Non http/https services often fail to go through cloudflare as well. For example, you're gonna have to reveal origin to use ftp/sftp.
Earlier quoted context omitted.
The free and $20 plan doesn't cover all DDoS attacks. The real stuff costs more than I spend on my entire monthly infrastructure. For my use case, it would cost $6000/mo (I need wildcards and full DDoS mitigation). I'm sure $6k is cheap for someone, but it's not cheap for us. Meanwhile, providers like OVH, Ramnode, Vultr and BuyVM offer various levels of integrated DDoS protection for their servers and VPS for free o…
OVH will nullroute you in about 3 seconds if you're affecting the stability of their network. I've been hit with a very large DDoS attack before, and our host nullrouted us because the attack was causing instability for our neighbors in the rack due to the switch being flooded with too much traffic.