One question, what's current best practice for DDOS prevention on my own VPS Ubuntu box ?
[deleted]
DDoS Protection
31–40 of 56 posts
Re: DDoS Protection
#32Earlier quoted context omitted.
Correct yes - although having used a provider that used Magic Transit as protection I can safely say it's a terrible option.
> I can safely say it's a terrible option. Can you elaborate?
It can't block most attacks. This was a few years ago though. Maybe it's better now.
Re: DDoS Protection
#33One question, what's current best practice for DDOS prevention on my own VPS Ubuntu box ?
Sometimes DDoS is 'layer 7', running you out of CPU etc on requests that are easy to make and hard to service. Try to avoid that?
Otherwise, DDoS is usually volumetric: send you more packets than will fit on your network interface. The only prevention is larger interfaces, but 1Gbps of DDoS was readily available when I was dealing with it in 2018ish and it was pretty clear that people were using the site I ran as a test target for DDoS as a service (always exactly 90 seconds of junk traffic on our www, very rarely a real service host, etc). There was a recent crackdown on DDoS as a service, but I'd be surprised if 10Gbps isn't easily available now.
Re: DDoS Protection
#34One question, what's current best practice for DDOS prevention on my own VPS Ubuntu box ?
Sometimes DDoS is 'layer 7', running you out of CPU etc on requests that are easy to make and hard to service. Try to avoid that? Otherwise, DDoS is usually volumetric: send you more packets than will fit on your network interface. The only prevention is larger interfaces, but 1Gbps of DDoS was readily available when I was dealing with it in 2018ish and it was pretty clear that people were using the site I ran as a t…
[deleted]
Re: DDoS Protection
#35For comparison, I believe AWS LightSail users might be covered for DDOS protection for free but maybe I'm reading too much into their statement. https://docs.aws.amazon.com/waf/latest/developerguide/ddos-s...
Might be "free" but then you also have to endure using AWS LightSail which you'll regret quickly.
Re: DDoS Protection
#36Earlier quoted context omitted.
Cloudflare doesn't proxy all applications, just HTTPS.
It can e.g. magic transit. Might cost a lot more and might not work as good, but you can.
Magic Transit is priced for the enterprise, out of reach for for a big chunk of the cheap VPS market: Minecraft servers and gaming in general, common DDOS targets.
Re: DDoS Protection
#37Earlier quoted context omitted.
What if you want to run a service that can't go behind Cloudflare (such as a game server)?
We have plenty of game servers behind us. See Cloudflare Spectrum: https://developers.cloudflare.com/spectrum/
Spectrum is cool but priced completely out of reach for most Cloudflare users.
I proxy through Fly.io or AWS Global Accelerator when I can’t use Cloudflare for TCP as a hobbyist.
(Why only three protocols and such strict limits, years after launching? You won’t cannibalize Spectrum by allowing more hobbyists to use it, you’ll market it for use at scale - like Argo Tunnel’s trycloudflare)
Re: DDoS Protection
#38> You will be charged up to 20% based on your total monthly resource usage covered by DDoS Protection with a total monthly maximum of $1000/mo. I get that someone has to pay for this, but if I had 50 servers here and they all got shit on, I'd be on the hook for a lot of money through no fault of my own.
AWS has an (expensive) option with DDoS cost protection.
Re: DDoS Protection
#39Earlier quoted context omitted.
Isn't it trivial to discover the origin IP and then just hit it directly?
How would you?
one method is to look up what IPs someone owns and try to direct connect to them. Or you can just guess and assume they picked an IP address near the start of the block they have.
Re: DDoS Protection
#40Earlier quoted context omitted.
How would you?
one method is to look up what IPs someone owns and try to direct connect to them. Or you can just guess and assume they picked an IP address near the start of the block they have.
That only works for companies that own blocks, though, and assumes a company big enough to own a block won't just drop non-Cloudflare traffic (which is trivial: https://www.stavros.io/posts/block-non-cloudflare-ips-with-u...).