4 ms·
This can protect you from simple DoS attack by some script kiddie, not real DDoS attack. Just use CloudFlare or a provider that have active protections against
by lossolo 7y ago
This can protect you from simple DoS attack by some script kiddie, not real DDoS attack. Just use CloudFlare or a provider that have active protections against DDoS attacks. Iptables will NOT help you with any real DDoS attack.
- RobertRoberts 7y agoIs there any other provider besides CloudFlare for DoS/DDoS protection?
- bearburger 7y agoNot free (actually, quite expensive imo), but one of my clients used Qrator. Don't know if it is any better or worse than CF.
- Gluten 7y agoOVH servers include a pretty efficient DDoS protection. It was the only option for hosting my online game servers that didn't cost tens of thousands.
- ce4 7y agoAny of the CDN providers (eg Akamai) offer this. Cloud providers as well
- Edmond 7y agoAkamai has Prolexic...it is what kept GitHub up.
- andrenth 7y agoIf you run your own BGP routers you can use Voxility, Incapsula or a number of similar services.
- acd 7y agoThere are many others for example Imperva, Akamai and Verisign.
- mustardo 7y agoA lot of CloudFlare is just iptables Sure they have bigger "tubes" as well https://blog.cloudflare.com/how-we-built-spectrum/ https://blog.cloudflare.com/how-we-built-spectrum/ https://blog.cloudflare.com/how-to-drop-10-million-packets/ https://blog.cloudflare.com/how-to-drop-10-million-packets/
- lossolo 7y agoI think you overestimate what iptables can do and for what they are used today. Most of the DDoS filtering is done using XDP, BPF, not iptables. Articles you linked contradict your thesis. In first article they write there about iptables but they use XDP most of the time because it's a better/more efficient solution. In second article they are using iptables for routing, not preventing DDoS.
- ycgeu 7y agoBigger tubes is 99.9% of CloudFlare, that's why you can't build a competing business.
- acd 7y agoYou can you build competing Cloudflare business if you are a tier one ISP. Other AntiDDos services exist like for example Akamai and Arbor networks. https://www.esecurityplanet.com/products/top-ddos-vendors.html https://www.esecurityplanet.com/products/top-ddos-vendors.ht...
- acd 7y agoCloudflare also used to use Apache mod_security. "Cloudflare WAF supports the OWASP ModSecurity Core Rule Set by default" https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/
- NightlyDev 7y agoOn host mitigation usually works. Most attacks are small. Iptables definetly can help with real ddos attacks.
- lossolo 7y ago> Iptables definetly can help with real ddos attacks. Maybe we have different definitions of real DDoS attacks. What you mean is probably DoS attack, not DDoS (distributed). If you have 1 gigabit pipe I can DoS (from one machine) you with 10 gigabit machine with ease and iptables will not help you at all.