12 ms·
DDoS protection
- esseti 10y agoIt was about time. So far the approach for DDoS on hetzner was not really business frendly (let's say so). (e.g. https://news.ycombinator.com/item?id=6577465 https://news.ycombinator.com/item?id=6577465)
- deleted 10y ago[deleted]
- 9191812919 10y agoPEARLS ==> SWINE
- deleted 10y ago[deleted]
- _Codemonkeyism 10y agoI'm having some servers at Hetzner (beside AWS and DigitalOcean) for the last 15 years and never had 8 hours of continuous downtime, so this really astonishes and scares me. Could you point to a Hetzner post where this has happened? (so I can reevaluate if I might move to OVH).
- 9191812919 10y agoWe all know nothing.
- jacquesm 10y agoNovelty account making pretty outrageous claims about some large service provider but can't back it up. I'd not put too much stock in this, Hetzner isn't perfect but almost a full day of unscheduled downtime does not match my experience.
- 9191812919 10y agoHail jacquesm!
- 921921031 10y agoYou are just like the loudest and most popular guy in the bar. How do you propose to "back up" such a claim after 4-5 years without the Internet archive (which was mentioned there before the GP changed his post in response to your mud slinging)?
- werid 10y agoI've had boxes at Hetzner for 9 years and have never had that much downtime.
- Shank 10y agoFor the record, I've had significant problems with network connectivity being constant at OVH's BHS datacenter. Even when presented with evidence that they're having downtime issues (repeated customer mentions on Twitter, New Relic reports, etc.), OVH refused to honor their SLA or even acknowledge the problem. I had a week with 96% uptime because of their network link problems.
- return0 10y agoI think it is much better these days
- mtmail 10y ago[parent commenter complained about 8 hour long downtimes and otherwise bad experience with Hetzner. He/she has since replaced the comment with insults to other HN users.] Counter experience: 4 years with Hetzner from small VPS to huge machines and based on traceroute servers in different sections/buildings of their datacenters. No hardware issues or hourlong downtimes you describe (other than myself messing up software RAID configuration).
- not_at_all 10y agoThis is not accurate. The complaint was about downtimes only. Nowhere did the original comment mention "otherwise bad experiences", in fact it mentioned the good value that you get for the price. The "insults" were clearly directed at the downvoters, thus at a small but nasty subset of HN users.
- sctb 10y agoWe've banned this account for repeatedly violating the guidelines.
- anc84 10y agoOfficial announcement: https://www.hetzner.de/hosting/news/hetzner-online-bietet-umfassenden-ddos-schutz https://www.hetzner.de/hosting/news/hetzner-online-bietet-um... (german)
- onestone 10y agoAlso in English: https://www.hetzner.de/ot/hosting/news/hetzner-online-bietet-umfassenden-ddos-schutz https://www.hetzner.de/ot/hosting/news/hetzner-online-bietet...
- fivesigma 10y agoCloudflare is a major source of centralization. The more providers offer something like this, the merrier. I understand that this isn't a layer 7 solution, but that has it's downsides as well - Cloudflare (or any other reverse proxy) will MITM all your TLS traffic, for example. It's also time to address the elephant in the room: AWS. "Oops, you got DDOS'ed? Here, have a $50k invoice"
- majke 10y ago[disclaimer: I work for CF] CloudFlare also regularly speaks about attacks and mitigations, therefore is helping the community to build better defences. Other providers stay shy and never disclose their magic. We believe DDoS is an internet wide problem and one of the ways to solve it is to spread the mitigation know how. Examples: - DNS attacks https://www.youtube.com/watch?v=UcAygzNSxlI&t=2h13m20s https://www.youtube.com/watch?v=UcAygzNSxlI&t=2h13m20s - Iptables is great https://www.youtube.com/watch?v=pCVTEx1ouyk https://www.youtube.com/watch?v=pCVTEx1ouyk - Our DDoS mitigation pipeline https://www.youtube.com/watch?v=XiK4643YdOk https://www.youtube.com/watch?v=XiK4643YdOk - BPF for DNS https://blog.cloudflare.com/introducing-the-bpf-tools/ https://blog.cloudflare.com/introducing-the-bpf-tools/ - BPF for SYN https://blog.cloudflare.com/introducing-the-p0f-bpf-compiler/ https://blog.cloudflare.com/introducing-the-p0f-bpf-compiler... - Kernel bypass with netmap https://blog.cloudflare.com/single-rx-queue-kernel-bypass-with-netmap/ https://blog.cloudflare.com/single-rx-queue-kernel-bypass-wi... - NTP attacks https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack/ https://blog.cloudflare.com/technical-details-behind-a-400gb... - DNS amplification https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/ https://blog.cloudflare.com/deep-inside-a-dns-amplification-... - Recent attack trends https://blog.cloudflare.com/a-winter-of-400gbps-weekend-ddos-attacks/ https://blog.cloudflare.com/a-winter-of-400gbps-weekend-ddos... - L7 attack with ad networks https://blog.cloudflare.com/mobile-ad-networks-as-ddos-vectors/ https://blog.cloudflare.com/mobile-ad-networks-as-ddos-vecto...
- scrollaway 10y agoCloudflare gets so much undeserved hate on HN. You guys do amazing work, provide an incredible service and your writeups are awesome. Thank you.
- nik736 10y agoI'm from Germany but Online.net is the way better alternative to Hetzner for me. Server grade hardware, cheaper, no compromises, internal network, etc. etc. I think they even hired a lot new support people recently so you get an answer pretty fast. Hetzner always has this "cheap feeling" even though the hardware looks good on paper.
- fabian2k 10y agoYou can get server grade hardware with the PX line at Hetzner, which is a bit more expensive of course. And an internal network is possible as well from what I read, though you have to pay for the Flexi pack because it counts as a modification of your server.
- nik736 10y agoThe internal network is a joke, it only works if you have all of your servers in one rack and you need to rent a switch to connect all of them. Online.net has a real RPN where you can add SAN storage to it etc etc. The PX line is a Fujitsu Desktop PC with a server CPU and ECC Ram. For me that's a compromise I don't really like. Also the network is a bit shitty since they don't route through DTAG (largest german carrier), you have to pay a premium so that they activate it for you, and that's only one thing that feels weird about Hetzner. Of course I understand the reasoning behind it, but still, why should I choose Hetzner if I can get a way better solution from Online.net?
- lossolo 10y agoIf you need xx TB storage servers then you will not find any cheaper hardware + storage + network option in EU than in hetzner. I have storage servers there.
- nik736 10y agoThat's true, I agree. If you just need cheap storage Hetzner is probably the way to go. On the other hand, if you need 24x 1 TB SSD storage with a 10gbit RPN connection: https://pbs.twimg.com/media/CblcJ2pUUAAtbhK.jpg https://pbs.twimg.com/media/CblcJ2pUUAAtbhK.jpg :-)
- bogomipz 10y agoCan someone from the EU or DE talk about where Hetzner sits reputation-wise for those not familiar with them. Are they a solid provider?
- PeterStuer 10y agoBeen running a single development server there for about 3 years, has been pretty solid.
- jpkeisala 10y agoThey don't have good reputation but I am Hetzner customer. I have run Windows Server and some smaller Linux boxes more than 2 years and I haven't had any problems. What I have understood from comments that you need to take care of everything yourself but that is really the same case in EC2 and Azure in the end of the day.
- WA 10y agoYes, they're solid. They exist for many years. I'm a customer since 2008 I think, but they're way older than that.
- bogomipz 10y agoWow thanks for the input. I am wondering if they are seeing an uptick in business for compliance reasons which is one of the reason I am asking actually.
- easychris 10y agoWe run a SaaS business there on ~25 servers with Hetzner. Besides small issues we are pretty happy. Feel free to email me if you want to know more details. Funnily I saw a thread on the customers forum at forum.hetzner.de today about why Hetzner does not have a better reputation social-media wise. Seems not to be on their priority list. There is even an English subforum, you may try to register there and ask for experience by other customers.
- discopicante 10y ago
- StanAngeloff 10y agoWe used to run some basic infrastructure on Hetzner. The support was appalling – any requests for help were swiftly met with short answers such as "Unfortunately we can not help you here". That makes me question how responsive and understanding Hetzner's staff will be in case of an on-going DDoS that their automated systems are unable to detect and take care of. What sort of scenario would benefit from the announced DDoS protection? People are surely not running websites on commodity hardware.
- dx034 10y agoAny server would profit from it, you don't need to have a public website to be DDoSd
- latch 10y agoWhat type of support issues? I had servers with hetzner for years and I never had any problems, which also means I never contacted support, so I can't say. I'm trying to figure out if you were expecting support for things that most dedicated, colo and cloud providers wouldn't support (OS updates, install nginx, ....) or if these were clearly provider issues (hardware and network). > People are surely not running websites on commodity hardware. Huh? That's been the growing trend for...decades? It feels like the two places where pure server-grade equipment is used, high end dedicated hosting and collocation, are losing market. I'd go as far as to say high-end dedicated hosting is flat out dying (yay!).
- StanAngeloff 10y agoIt didn't come across in my comment – my amazement was regarding WordPress, etc. websites being run on commodity hardware without proper backups. E.g., get that ludicrous 128GB machine and run Apache on it with a single website for years. What could possibly go wrong? The most recent issue we had with Hetzner was when we requested a LARA remote console to connect to a failing machine. The standard keyboard on the remote is German and much of the non-Latin keys are remapped. It was impossible to log in to a shell. All we got from support was "This is a standard Generic 104 key layout". That was it. Before that Hetzner rebooted a whole raft of machines and on one of them this corrupted ext2. We asked what prompted the reboot (not bothered by the dead server) and we got (as above) "Unfortunately we can not help you here". There were many more incidents before that and at the end it was just too much to swallow so we moved away. Just out of interest, what's your use case for Hetzner?
- psynapse 10y agoI host at Hetzner and have noticed reduced Fail2ban notifications and shorter Logwatch emails recently. If this has kicked it, I guess that might explain it.
- ryanlol 10y agoThat'd be somewhat worrying, DDoS protection shouldn't be dropping non DDoS packets. If the chinese bruteforcers can't get to your server there's a very good chance your users can't either.
- jensC 10y agoI always liked Hetzner and I have a few dedicated servers there. Their service was always fast and very competent. However they are not soo cheap compared to other hosters anymore.
- davidspiess 10y agoWe are switching away from hetzner managed server as we had ~30 hours of downtime this sunday. They suddenly swapped our valid ssl certificate with a self signed one. They offered no immediate support (i called them three times) and open tickets were left unanswered for another ~20 hours. As i ranted about their customer service on twitter, they finally took care of it. So please stay away from them.
- paride5745 10y ago> we had ~30 hours of downtime this sunday 30 hours in a 24 hours day? :O
- davidspiess 10y agoFrom Sunday 11 pm to tuesday morning
- zAy0LfpBZLC8mAC 10y agoFree? How about mandatory? I hate blackboxes in my communication channel that decide which communication is acceptable and which isn't. Plus all the security vulnerabilities and other bugs that the complexity of such systems probably brings with it, making it harder and harder to debug network problems. And all that is especially true in the case of Hetzner, who have repeatedly demonstrated how to build hilariously broken networks. Even ignoring that they were vulnerable to ARP spoofing for a long time and other things that have since been fixed, just some blunders of their current offerings: virtual servers behind v4 NAT (yes, you can't make that shit up ...) and IPv6 assignments of a single /64, even for dedicated machines (with an option to extend it to a /56 for money). So, if their new blackbox screws something up, what are the chances that they will care?
- stemuk 10y agoWhat always strikes me is the amount of free traffic Hetzner includes in their plans, always 20TB and upwards. AWS charges a whooping 90$ per TB, it keeps me wondering why their traffic is SO much more expensive than Hetzner's...
- corobo 10y agoCan you actually use that traffic though? I can run AWS bandwidth at max for the entire month and (assuming I'm not spamming or whatever) I just get a bigger bill. With places like Hetzner you may be shut down for abusing their services if you use that limit too frequently.
- Medowar 10y agonah, wrong. If you go over the allowed bandwith, you can get either limited to 10Mbit/s or pay 1,37€ per TB. In comparison, this is pretty cheap, but that is about waht you pay, when you buy transit. Source: https://wiki.hetzner.de/index.php/Traffic/en https://wiki.hetzner.de/index.php/Traffic/en
- Medowar 10y agocorrection, 1,17€/TB
- kuschku 10y agoSimple, Hetzner directly buys at transit wholesale prices.
- jpalomaki 10y agoI see great future for companies like Hetzner which are providing dedicated hardware with reasonable prices. While Amazon and Azure are making the live of virtual server providers difficult, I believe it is harder for them to compete with companies like Hetzner without eating their own business. What these companies need are just additional services and nice management tools which make the whole dedicated server and network stuff look more like what we see on AWS or Azure. My assumption is that at some point more people will come to the conclusion that part of their workloads such actually run on cheap dedicated hardware. On Hetzner €60/month buys you 4 cores, 32GB, 480GB SSD, 30TB traffic. Compare that to Azure A2, which at €64/month gives you 2 cores, 3.5GB, 60GB.
- cosmins 10y agoI used Hetzner, they have one of the worst support teams out there. Everything is next to unlimited and blah blah blah but the reality is really painfull for their customers including myself as a former one.
- seqizz 10y agoSadly I have the same experience. They lost me after a small ddos (which results null routing our ip).
- cosmins 10y agoI wouldn't buy DDoS protection from Hetzner, not to talk about using it for free. There is no such things as free ddos protection which means tons of free bandwidth, this cheap marketing.
- Kephael 10y agoHetzner announced this a couple weeks ago on their German language forums. What's concerning is they still have not stated their filtering capacity and the bandwidth and throughput protection levels being provided. If it's only 5 gbit and 500k PPS of filtering it won't be all that helpful.
- bedbey 10y agoonline.net has serious bios problems. their ddos protection is a joke. yes they have arbor but they are not able to use it right. unmetered isn't unmetered ! they will kick you if you use to much traffic. their connection to amsix was very bad for weeks, its now good but they first oversell the network and do the upgrades to late. look on lowendtalk how bad they are
- deleted 10y ago[deleted]
- Namidairo 10y agoIf I remember correctly, didn't this host have their entire address space banned from a couple IRC networks because their support wouldn't act on abuse reports?
- znarfor 10y agoThis is what I expect from any serious hosting company know: DDoS protection for every customer as part of the service. It's part the hosting duties and should not be offloaded to any third party company, say Cloudflare.
- rmdoss 10y agoThat's a great move by Hetzner. Glad to see that OVH is not the only main player doing it anymore. The only issue with both is that they don't handle l7 DDoS, which seems to be getting more common. I also don't like that they leverage TCP rst's for syn floods, but I guess thats better than going down. But so far, for l7 attacks you still need ddos mitigation strategies or something like CloudFlare.com or https://sucuri.net https://sucuri.net in front of your site. thanks,
- kuschku 10y agoIt seems you’re affiliated with Sucuri, I wonder why you don’t include that in your profile?
- daap00 10y agoI'd have to say that webtropia.com or even myloc.de great service great value myloc has some real nice bells and whistles. webtropia has great vps and the dedi servers too. I'm at 2 locations east side USA and Deutschland. Check it out, I'm happy.
- vizzah 10y agoDoes it mean Hetzner won't pull the cable off your server now if/when it's under heavy DDoS? I read horror stories about customers being attacked and Hetzner disabling their servers. Never experienced it myself, but I host my playground server with them and chose OVH for a more serious project due to DDoS policies..
- DisposableMike 10y agoI wish that Hetzner would provide me with DDoS protection from THEIR users. I've blacklisted their entire IP space for several different customers because of the relentless onslaught of malicious and aggressive attacks originating from their networks. They have never responded to a single abuse notification.
- ex3ndr 10y agoRecently moved from Google Cloud (8x less price - 4x more power) and we got ~100kb/s of constant traffic from countries like china. fail2ban usually locks me for day or two until i disabled password-based auth and fail2ban.
- dx034 10y agoDisabling fail2ban doesn't sound like the best solution. Why did it lock you out? If your username is not public and root has no password the locks shouldn't affect you.