5 ms·

This is not real DDoS protection since it does not deal with jamming the pipes. It is more of a resource exhaustion protection.

RobertRoberts 7y ago
Would this be useful for small lightly trafficked sites that may get hit by small time attackers? Would this hit a sweet spot between a grandma's blog with straight HTML and massively trafficked sites like Wikipedia? Resource exhaustion seems like a useful feature of _some_ kind of system. What does that system look like?
- dylz 7y ago
  It is not useful for small time attackers - small time attackers/children/etc just use booters which at least usually output double digit gbps, often spoofed, costs a cent or pay in runescape gold or other bullshit like that. Your upstream will need to mitigate this. No small scale attacker will be launching their own attacks (from their own machines), unless they were seriously incompetent but also think they're some form of power user, which doesn't really happen... It is not useful for straight HTML - volumetric DDoS will take it out (not l7), it's not even going to make it to your machine. It does not mitigate well against any real major l7 flood either, just by virtue of "your pipe is smaller". A formal l7 attack would at least do basic recon to find a high resource consumption page (like search.php?q=%20 or something) I guess this would come in maybe slightly useful with someone running ab or jmeter from a single machine toward you? But I don't know a single instance of that happening in the last decade..
  - brians 7y ago
    It’s great against mistaken API clients. Murphy is the most frequent adversary I encounter.
    - dylz 7y ago
      I feel like there's a bunch of other things in play, like for example if you're running a public API, one api key should not be able to take you down - you should be rate limiting them against repeated hits, for instance. I'm not saying iptables is bad per se, but this article in particular is just some overpriced hosting provider's blog that tells you to set things like kernel.panic in sysctl. The article also claims all of this to be a defense against DDoS, which really will probably just eat through your pipe completely most of the time, not single-person DoS.
- StreamBright 7y ago
  "Small time attackers" are doing __distributed__ denial of service? I guess if they do not have enough bandwidth but has enough req/s, you can protect yourself something like the article suggests. In my dictionary DDOS is when they are jamming the pipes.
NightlyDev 7y ago
It clearly states that it's for TCP based attacks. TCP attacks eg. SYN floods is a real problem and this does help against most such attacks. Just as real as anything else...
- ce4 7y ago
  only for DoS, not DDoS. i.e. if you omit the distributed from Denial of Service, then iptables will work. Not so when the attack exhausts either your bandwidth or your stack's filtering capabilities. it's easy to rent GBits of distributed attack bandwidth.
- StreamBright 7y ago
  Most modern Unixes have syn cookies. You do not necessarily need anything else.
  - NightlyDev 7y ago
    You still have to do some tuning and at least assign RX queues properly. You want to drop unwanted traffic before you start spending more cycles on it.

RobertRoberts 7y ago

Would this be useful for small lightly trafficked sites that may get hit by small time attackers? Would this hit a sweet spot between a grandma's blog with straight HTML and massively trafficked sites like Wikipedia? Resource exhaustion seems like a useful feature of _some_ kind of system. What does that system look like?

dylz 7y ago
It is not useful for small time attackers - small time attackers/children/etc just use booters which at least usually output double digit gbps, often spoofed, costs a cent or pay in runescape gold or other bullshit like that. Your upstream will need to mitigate this. No small scale attacker will be launching their own attacks (from their own machines), unless they were seriously incompetent but also think they're some form of power user, which doesn't really happen... It is not useful for straight HTML - volumetric DDoS will take it out (not l7), it's not even going to make it to your machine. It does not mitigate well against any real major l7 flood either, just by virtue of "your pipe is smaller". A formal l7 attack would at least do basic recon to find a high resource consumption page (like search.php?q=%20 or something) I guess this would come in maybe slightly useful with someone running ab or jmeter from a single machine toward you? But I don't know a single instance of that happening in the last decade..
- brians 7y ago
  It’s great against mistaken API clients. Murphy is the most frequent adversary I encounter.
  - dylz 7y ago
    I feel like there's a bunch of other things in play, like for example if you're running a public API, one api key should not be able to take you down - you should be rate limiting them against repeated hits, for instance. I'm not saying iptables is bad per se, but this article in particular is just some overpriced hosting provider's blog that tells you to set things like kernel.panic in sysctl. The article also claims all of this to be a defense against DDoS, which really will probably just eat through your pipe completely most of the time, not single-person DoS.
StreamBright 7y ago
"Small time attackers" are doing __distributed__ denial of service? I guess if they do not have enough bandwidth but has enough req/s, you can protect yourself something like the article suggests. In my dictionary DDOS is when they are jamming the pipes.

NightlyDev 7y ago

It clearly states that it's for TCP based attacks. TCP attacks eg. SYN floods is a real problem and this does help against most such attacks. Just as real as anything else...

ce4 7y ago
only for DoS, not DDoS. i.e. if you omit the distributed from Denial of Service, then iptables will work. Not so when the attack exhausts either your bandwidth or your stack's filtering capabilities. it's easy to rent GBits of distributed attack bandwidth.
StreamBright 7y ago
Most modern Unixes have syn cookies. You do not necessarily need anything else.
- NightlyDev 7y ago
  You still have to do some tuning and at least assign RX queues properly. You want to drop unwanted traffic before you start spending more cycles on it.