AWS Best Practices for DDoS Resiliency [pdf] • Hacker News Board

Re: AWS Best Practices for DDoS Resiliency [pdf]

#41

Post by developer1 » Sat, Jul 04, 2015, 10:57 PM UTC

robbles wrote: post #31

buro9 wrote: post #12

Earlier quoted context omitted.

Best way to defend against an L7 DDoS is to have the origin hidden, and to cache everything at a large number of geographically distributed PoPs. This helps in 99% of cases, and where it doesn't it is simply because there is a resource that cannot be cached and that the edge must revisit the origin for. This is especially true whenever that resource is expensive for the origin to provide (involves database lookups an…

What's the limit at which CloudFlare will start billing you at a "enterprise rate" instead of $20 / month? That bandwidth can't be free forever...

Any company using the massive amount of bandwidth you are thinking of is probably not getting all the features required for their business on the $20/month plan. Hell, you can't even obtain access logs without the enterprise pricing. Your limit won't come from CloudFlare restricting you, a lack of basic necessities from the product will have you crawling to pay whatever enterprise amount they want.

Re: AWS Best Practices for DDoS Resiliency [pdf]

#42

Post by [deleted] » Sat, Jul 04, 2015, 11:21 PM UTC

toomuchtodo wrote: post #36

ra1n85 wrote: post #18

Earlier quoted context omitted.

Sounds like there could be awesome features here. Remotely triggered black holes for VPC? Elastic Firewall? Not crazy about firewalls in general, but they would help in the case that you are paying for data-out.

Firewalls are useless in a DDOS attack.

[deleted]

Re: AWS Best Practices for DDoS Resiliency [pdf]

#43

Post by manigandham » Sun, Jul 05, 2015, 12:20 AM UTC

derefr wrote: post #37

manigandham wrote: post #35

Earlier quoted context omitted.

CloudFlare has CNAME flattening so you can still have the apex point to a CNAME and CF will automatically keep up to date with the correct IP using the TTLs and broadcast an A record correct to RFC standards. https://support.cloudflare.com/hc/en-us/articles/200169056-C...

Do you know if CloudFlare's apex CNAME support works coupled to Route53's health-check-based RRDNS? I know that AWS's own DNS reflects the health-check-based changes to the round-robin pools instantaneously, but I have no idea what sort of TTLs they emit.

Haven't used Route53 recently but those TTLs should be configurable by you. Obviously the lower the better to keep propagation time low for changes. CloudFlare has more info in the blog post [1] that says they do respect the TTLs that are given for records and then cache the value until expiration so I'm assuming they also send along the same TTL value of the original lookup.

There's no way to ensure the rest of the internet will handle it correctly though with all the proxies and DNS caches in the middle and low TTLs can also add latency to end-users who might have to constantly do a DNS lookup on new connections.

If you're using CloudFlare's full service (instead of just DNS), then it'll be seamless because their IPs don't change.

[1] https://blog.cloudflare.com/introducing-cname-flattening-rfc...

Re: AWS Best Practices for DDoS Resiliency [pdf]

#44

Post by derefr » Sun, Jul 05, 2015, 1:07 AM UTC

kyledrake wrote: post #33

The AWS best practice for DDoS, TLDR: Use anything except AWS unless you like going bankrupt in a day.

I think this could be better summed up as a guide to maintaining uninterrupted service during a DDoS. Which is only something you do in the first place if you run the numbers and find that being down would cost you more in lost revenue than staying up would cost you in temporary overprovisioning. It's another of those "a solution to a problem that only really exists at Amazon/Google/Facebook scale" whitepapers, except in this case the relevant "scale" is economic, not technical.

Re: AWS Best Practices for DDoS Resiliency [pdf]

#45

Post by shitlord » Sun, Jul 05, 2015, 1:20 AM UTC

toomuchtodo wrote: post #36

ra1n85 wrote: post #18

Earlier quoted context omitted.

Sounds like there could be awesome features here. Remotely triggered black holes for VPC? Elastic Firewall? Not crazy about firewalls in general, but they would help in the case that you are paying for data-out.

Firewalls are useless in a DDOS attack.

If you use BPF, you should be able to filter out the bad traffic effectively. Although, if you're getting flooded with an absurd amount of traffic (faster than the network card can consume), then there's nothing to do.

Re: AWS Best Practices for DDoS Resiliency [pdf]

#46

Post by nullrouted » Sun, Jul 05, 2015, 4:37 AM UTC

chdir wrote: post #25

Kind of agree with all those who say that Cloudflare is still a better option. But how do you tackle their lack of automatic failover ? https://support.cloudflare.com/hc/en-us/articles/200168916-C... "the system currently does not have the functionality to automatically select the next available server if one of the servers in the group goes down"

Use runbook.io and load balancers.....done.

Re: AWS Best Practices for DDoS Resiliency [pdf]

#47

Post by ju-st » Mon, Jul 06, 2015, 3:47 PM UTC

nacs wrote: post #38

ju-st wrote: post #7

AWS' competition like OVH and many quality VPS providers offer _free_ (or very cheap) DDOS protection.

Which VPS providers are you referring to? I know from personal experience that, Digital Ocean, the largest VPS provider null routes your VPS IP for 3 hours minimium for even the tiniest of DDoS's. I doubt most of the smaller VPS providers can afford to absorb DDoS's even if they don't have overly restrictive policies like DO.

I was thinking about these providers:

buyvm.net for 3$ per month (100Gbit apparently)

iwstack.com, 8Gbit protection for free

ramnode.com, 20Gbit